backstage/.changeset/2804.md

@backstage/plugin-proxy-backend

@backstage/plugin-proxy-backend
minor

Limit the http headers that are forwarded from the request to a safe set of defaults. A user can configure additional headers that should be forwarded if the specific applications needs that.

proxy:
  '/my-api':
    target: 'https://my-api.com/get'
    allowedHeaders:
      # We need to forward the Authorization header that was provided by the caller
      - Authorization