HTTP Headers

You can configure the Forwarded, X-Forwarded-* and X-Real-IP headers of outbound requests with these options:

• Set headers:
  • forwarded.set_outbound.forwarded: sets the Forwarded header per RFC 7239 specifications, using the parameters for, by, host, and proto
  • forwarded.set_outbound.x-forwarded: sets X-Forwarded-For header to chain of IP addresses from the original client to the last proxy server
  • forwarded.set_outbound.x-real-ip: sets the X-Real-IP header to the original client IP address
• Preserve headers of the inbound request (use only if you trust the request source):
  • forwarded.preserve_inbound.forwarded: preserves the inbound Forwarded header
  • forwarded.preserve_inbound.x-forwarded: preserves the inbound X-Forwarded-For header
  • forwarded.preserve_inbound.x-real-ip: preserves the inbound X-Real-IP header

caution

Only preserve inbound headers if you trust the source of the inbound request to avoid spoofed headers.

Here's an example configuration:

Environment variables

GATE_HEADERS_FORWARDED_SET_OUTBOUND_FORWARDED=true
GATE_HEADERS_FORWARDED_SET_OUTBOUND_X_FORWARDED=true
GATE_HEADERS_FORWARDED_SET_OUTBOUND_X_REAL_IP=true

GATE_HEADERS_FORWARDED_PRESERVE_INBOUND_FORWARDED=true
GATE_HEADERS_FORWARDED_PRESERVE_INBOUND_X_FORWARDED=true
GATE_HEADERS_FORWARDED_PRESERVE_INBOUND_X_REAL_IP=true

HCL

gate = {
  headers = {
    forwarded = {
      set_outbound = {
        forwarded   = true
        x-forwarded = true
        x-real-ip   = true
      }
      preserve_inbound = {
        forwarded   = true
        x-forwarded = true
        x-real-ip   = true
      }
    }
  }
}

JSON

{
  "gate": {
     "headers": {
      "forwarded": {
        "set_outbound": {
          "forwarded": true,
          "x-forwarded": true,
          "x-real-ip": true
        },
        "preserve_inbound": {
          "forwarded": true,
          "x-forwarded": true,
          "x-real-ip": true
        }
      }
    }
  }
}

TOML

[gate.headers]
forwarded.set_outbound.forwarded = true
forwarded.set_outbound.x-forwarded = true
forwarded.set_outbound.x-real-ip = true

forwarded.preserve_inbound.forwarded = true
forwarded.preserve_inbound.x-forwarded = true
forwarded.preserve_inbound.x-real-ip = true

YAML

gate:
  headers:
    forwarded:
      set_outbound:
        forwarded: true
        x-forwarded: true
        x-real-ip: true

      preserve_inbound:
        forwarded: true
        x-forwarded: true
        x-real-ip: true

To debug issues with the configuration of HTTP headers, use log level trace.

Disable Via headers

By default, Gate adds a Via header to all response. You can disable this behaviour with the following option:

Environment variables

GATE_HEADERS_VIA_DISABLED=true

HCL

gate = {
  headers = {
    via = {
      disabled = true
    }
  }

  // ...
}

JSON

{
  "gate": {
    "headers": {
      "via": {
        "disabled": true
      }
    }
    // ...

TOML

[gate.headers]
via.disabled = true

YAML

gate:
  headers:
    via:
      disabled: true

## Remove inbound request headers

Some request headers should only ever be set by a trusted hop between Gate and your upstream, never by a client. Gate can remove such headers from every inbound request, so a client cannot spoof them:

• The headers are removed before URL matching, request signature verification and all plugins, so neither the plugins nor the upstream see them. A plugin can still set a header with one of these names.
• Don't list a header that is a signed component of your request signatures.
• Names are case-insensitive, and every value of a multi-valued header is removed. Only request headers are affected, not request trailers.
• Propagation headers you list (for example baggage or traceparent) are removed before trace-context extraction.
• In ext_auth mode, Gate always tells Envoy to remove every listed header. If your ext_authz filter sets allowed_headers, include every listed header there too, so the plugins can't see them either.
• Not supported in aws_lambda_auth mode: a non-empty list is a configuration error there.
• Connection-level headers (Connection, Upgrade, Host, Content-Length, Transfer-Encoding, TE, Trailer, Keep-Alive, Proxy-Connection) and HTTP/2 pseudo-headers can't be listed.

Environment variables

Use a comma-separated list with no spaces around the commas:

GATE_HEADERS_REMOVE_INBOUND=X-Internal-Hop,X-Internal-Trusted

HCL

gate = {
  headers = {
    remove_inbound = ["X-Internal-Hop", "X-Internal-Trusted"]
  }

  // ...
}

JSON

{
  "gate": {
    "headers": {
      "remove_inbound": ["X-Internal-Hop", "X-Internal-Trusted"]
    }
    // ...

TOML

[gate.headers]
remove_inbound = ["X-Internal-Hop", "X-Internal-Trusted"]

YAML

gate:
  headers:
    remove_inbound:
      - X-Internal-Hop
      - X-Internal-Trusted