# 1.5 — Header hygiene (GREEN)

Phase: 1 — Proxy core
Stage: GREEN
Depends on: [1.1](1.1-reverse-proxy.md)

- [ ] Hop-by-hop headers are stripped from both the upstream request and the client response
- [ ] Headers named in a request's `Connection` header are also stripped, not just the fixed hop-by-hop list
- [ ] `X-Forwarded-For` appends the immediate peer to the nginx-supplied value rather than replacing or fabricating it
- [ ] `X-Forwarded-Proto` and `X-Forwarded-Host` are taken from the nginx-supplied values when present
- [ ] Client-supplied `X-Forwarded-*` values are not trusted when the request did not arrive from the trusted ingress peer
- [ ] End-to-end headers, including `Content-Type`, `Authorization` where the route requires it, and upstream response headers, pass through unchanged
- [ ] A test asserts the exact header set the stub upstream receives

ingress-nginx owns TLS and the edge, so it is the only source of truth for the
original scheme, host and client address. The gateway fabricating these would make
every upstream's view of the caller wrong, and would let a client spoof its own
source address by sending the header itself.

## Verify

```bash
go test ./internal/proxy/... -run TestHeaderHygiene -v
# expected: passes — stub upstream sees no Connection/Keep-Alive/TE/Upgrade/
# Proxy-Authorization headers, sees X-Forwarded-For ending in the nginx-supplied value
# plus the peer, and a spoofed X-Forwarded-Proto from an untrusted peer is discarded
```