diff --git a/docs/plugins/proxying.md b/docs/plugins/proxying.md index 0e57a9a72a..26329f8475 100644 --- a/docs/plugins/proxying.md +++ b/docs/plugins/proxying.md @@ -110,13 +110,13 @@ There are also additional settings: from the target. By default, the proxy will only forward safe HTTP request headers to the target. -Those are based on the headers that are considered safe for CORS and includes +These are based on the headers that are considered safe for CORS and include headers like `content-type` or `last-modified`, as well as all headers that are -set by the proxy. If the proxy should forward other headers like +set by the proxy. If the proxy should forward other headers, like `authorization`, this must be enabled by the `allowedHeaders` config, for example `allowedHeaders: ['Authorization']`. This should help to not accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to -third-parties. +third parties. The same logic applies to headers that are sent from the target back to the frontend.