From 25cc1ec455e626e2fc4ff22ba68c6b0526616cbe Mon Sep 17 00:00:00 2001
From: haumlab <222520099+b1ume@users.noreply.github.com>
Date: Sat, 25 Jul 2026 18:28:45 +0100
Subject: [PATCH] fix: stop forwarding client Authorization header to
 downstream apps

setHeaders was passing the incoming Authorization header straight
through to the backend on every proxy request. If someone uses Basic
Auth their creds end up forwarded. The Basic Auth passthrough from
ACLs config still works.
---
 internal/controller/proxy_controller.go | 2 --
 1 file changed, 2 deletions(-)

diff --git a/internal/controller/proxy_controller.go b/internal/controller/proxy_controller.go
index cc398d1d..9b7cad9a 100644
--- a/internal/controller/proxy_controller.go
+++ b/internal/controller/proxy_controller.go
@@ -305,8 +305,6 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 }
 
 func (controller *ProxyController) setHeaders(c *gin.Context, acls *model.App) {
-	c.Header("Authorization", c.Request.Header.Get("Authorization"))
-
 	if acls == nil {
 		return
 	}