Skip to content

fix(proxy-rewrite): transform header names to lower case before removal - #13816

Open
bearn01d wants to merge 1 commit into
apache:masterfrom
bearn01d:fix/header-removal-case
Open

fix(proxy-rewrite): transform header names to lower case before removal#13816
bearn01d wants to merge 1 commit into
apache:masterfrom
bearn01d:fix/header-removal-case

Conversation

@bearn01d

Copy link
Copy Markdown

Description

In line with the specification of HTTP/2, APISIX apparently processes all headers in lower case. For this reason, entries of the headers.remove section in proxy-rewrite that contain capital letters are ignored, also in cases where the client sends them with capital letters. This may lead to unintended data leaks.
This PR transforms headers in headers.remove to lower case to ensure removal of all headers intended to be removed.

The docs seem to intend the behavior this PR establishes.

Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

@dosubot dosubot Bot added size:XS This PR changes 0-9 lines, ignoring generated files. bug Something isn't working labels Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant