Merge pull request #17959 from dweber019/fix/proxy-backend-secrets

fix: don't expose sensible data in proxy backend

.changeset/selfish-carrots-sneeze.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-proxy-backend': patch
+---
+
+Marked headers `Authorization` and `X-Api-Key` as secret in order to not show up in frontend configuration.

plugins/proxy-backend/config.d.ts

@@ -31,7 +31,17 @@ export interface Config {
           /**
            * Object with extra headers to be added to target requests.
            */
-          headers?: { [key: string]: string };
+          headers?: Partial<{
+            /** @visibility secret */
+            Authorization: string;
+            /** @visibility secret */
+            authorization: string;
+            /** @visibility secret */
+            'X-Api-Key': string;
+            /** @visibility secret */
+            'x-api-key': string;
+            [key: string]: string;
+          }>;
           /**
            * Changes the origin of the host header to the target URL. Default: true.
            */