{"version":"2.1.246","anchor":"a-tunnel-request-mode-that-strips-inherited-headers","canonical_anchor":"a-tunnel-request-mode-that-strips-inherited-headers","heading":"A tunnel request mode that strips inherited headers","tier":"internal","area":"Internals","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246\/e\/a-tunnel-request-mode-that-strips-inherited-headers","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246","markdown":"### A tunnel request mode that strips inherited headers\n\nRequests can be sent through a tunnel host with inherited headers stripped, only for callers that ask.\n\n**What**\n\nThe shared HTTP request helper accepts a new tunnel option that sends the request to a tunnel host instead of the normal API base URL and removes a reserved set of headers before sending. It only does anything for callers that pass the option, and it refuses to run unless the request also targets the frame host with no authentication.\n\n**Details**\n\n- Any header whose lowercased name is in the reserved set is deleted, so headers inherited from the surrounding request are not forwarded through the tunnel.\n- Misuse throws with the message \"frameTunnel requires host 'frame' and auth 'none'\".\n\n**Evidence**\n\n`frameTunnel requires host 'frame' and auth 'none'`\n\n- Area: Internals\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 3\/5"}