What
When Claude Code forwards requests through a proxy, it now applies explicit rules about which HTTP headers (the metadata sent alongside a request) are allowed through. Headers considered sensitive or connection-specific, such as authorization, x-api-key, host, and content-length, are stripped out. Headers whose names start with certain prefixes, including anthropic-, x-stainless-, x-claude-gateway-, x-goog-, x-amz-, and x-amzn-, are kept. New validity checks also confirm header names and values are well-formed.
Why
This reduces the risk of sensitive credentials or connection-specific headers leaking through a proxied request, while still allowing the specific headers that upstream services need to function correctly.