Merge pull request #2804 from SDA-SE/feat/proxy-headers

feat(proxy-backend): limit the forwarded http headers to a safe set
2020-10-08 15:41:47 +02:00
parent ba0e6fa4ea 9226c2aaa0
commit c87655914c
7 changed files with 256 additions and 4 deletions
@@ -0,0 +1,15 @@
+---
+'@backstage/plugin-proxy-backend': minor
+---
+
+Limit the http headers that are forwarded from the request to a safe set of defaults.
+A user can configure additional headers that should be forwarded if the specific applications needs that.
+
+```yaml
+proxy:
+  '/my-api':
+    target: 'https://my-api.com/get'
+    allowedHeaders:
+      # We need to forward the Authorization header that was provided by the caller
+      - Authorization
+```