{"version":"2.1.277","anchor":"proxy-request-forwarding-gains-an-explicit-header-allowdeny","canonical_anchor":"proxy-request-forwarding-gains-an-explicit-header-allowdeny","heading":"Proxy request forwarding gains an explicit header allow\/deny list","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277\/e\/proxy-request-forwarding-gains-an-explicit-header-allowdeny","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277","markdown":"### Proxy request forwarding gains an explicit header allow\/deny list\n\nProxy request forwarding now strips sensitive headers and keeps only an allowed set of prefixes\n\n**What**\n\nWhen Claude Code forwards requests through a proxy, it now applies explicit rules about which HTTP headers (the metadata sent alongside a request) are allowed through. Headers considered sensitive or connection-specific, such as `authorization`, `x-api-key`, `host`, and `content-length`, are stripped out. Headers whose names start with certain prefixes, including `anthropic-`, `x-stainless-`, `x-claude-gateway-`, `x-goog-`, `x-amz-`, and `x-amzn-`, are kept. New validity checks also confirm header names and values are well-formed.\n\n**Why**\n\nThis reduces the risk of sensitive credentials or connection-specific headers leaking through a proxied request, while still allowing the specific headers that upstream services need to function correctly.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}