This extension may be referenced by the qualified name envoy.filters.http.router


This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Router configuration overview.


[config.filter.http.router.v2.Router proto]

  "dynamic_stats": "{...}",
  "start_child_span": "...",
  "upstream_log": [],
  "suppress_envoy_headers": "...",
  "strict_check_headers": [],
  "respect_expected_rq_timeout": "..."

(BoolValue) Whether the router generates dynamic cluster statistics. Defaults to true. Can be disabled in high performance scenarios.


(bool) Whether to start a child span for egress routed calls. This can be useful in scenarios where other filters (auth, ratelimit, etc.) make outbound calls and have child spans rooted at the same ingress parent. Defaults to false.


(config.filter.accesslog.v2.AccessLog) Configuration for HTTP upstream logs emitted by the router. Upstream logs are configured in the same way as access logs, but each log entry represents an upstream request. Presuming retries are configured, multiple upstream requests may be made for each downstream (inbound) request.


(bool) Do not add any additional x-envoy- headers to requests or responses. This only affects the router filter generated *x-envoy-* headers, other Envoy filters and the HTTP connection manager may continue to set x-envoy- headers.


(string) Specifies a list of HTTP headers to strictly validate. Envoy will reject a request and respond with HTTP status 400 if the request contains an invalid value for any of the headers listed in this field. Strict header checking is only supported for the following headers:

Value must be a ‘,’-delimited list (i.e. no spaces) of supported retry policy values:

Value must be an integer:


(bool) If not set, ingress Envoy will ignore x-envoy-expected-rq-timeout-ms header, populated by egress Envoy, when deriving timeout for upstream cluster.