kamal-proxy and headers policy

[y-nk]

does kamal-proxy enforces best practices in security such as removing x-powered-by and such? if not, wouldn't that be a good (opt-in) config feature to have?

[kevinmcconnell]

@y-nk Kamal Proxy tries to be as transparent as possible when handling headers. In general all the request and response headers will pass through it unmodified. The proxy doesn't set any headers of its own like X-Powered-By, but if you have an app server that sets one it won't strip it out either. I think this policy makes sense.

One exception to this is the handling of the X-Forwared-* headers in requests, for example X-Forwarded-For. It's not necessarily safe to forward these to the upstream since we don't know if they were set by a trusted source. So in that case, we provide the option to enable or disable forwarding them (via --forward-headers). By default we won't forward the headers if Kamal Proxy is also responsible for terminating the TLS on the service, because that maps to a common scenario where the direct client is not trusted (i.e. Kamal Proxy exposed directly on the Internet). But in any case you can use the --forward-headers option if you need to change that default.

[y-nk]

i do understand your point, thanks for providing such a clear answer.

would you be open to a PR to add a strip-headers option which would he an exhaustive list of headers to strip?

since it's optional it'd be non breaking/invasive, but i think it'd help lots of app to avoid relying on middlewares and such.