From b229f0d9de4bdcbe25517340096ed170dc6b9438 Mon Sep 17 00:00:00 2001 From: deepthi-28 Date: Thu, 6 Mar 2025 11:11:17 +0530 Subject: [PATCH] Proxying doc changed Signed-off-by: deepthi-28 --- docs/plugins/proxying.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/plugins/proxying.md b/docs/plugins/proxying.md index 0e57a9a72a..26329f8475 100644 --- a/docs/plugins/proxying.md +++ b/docs/plugins/proxying.md @@ -110,13 +110,13 @@ There are also additional settings: from the target. By default, the proxy will only forward safe HTTP request headers to the target. -Those are based on the headers that are considered safe for CORS and includes +These are based on the headers that are considered safe for CORS and include headers like `content-type` or `last-modified`, as well as all headers that are -set by the proxy. If the proxy should forward other headers like +set by the proxy. If the proxy should forward other headers, like `authorization`, this must be enabled by the `allowedHeaders` config, for example `allowedHeaders: ['Authorization']`. This should help to not accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to -third-parties. +third parties. The same logic applies to headers that are sent from the target back to the frontend.