fix: stop forwarding client Authorization header to downstream apps

[b1ume]

setHeaders was piping the client's Authorization header straight through to the downstream app on every request. if someone auths via Basic Auth their creds end up in the backend. even with session-based auth, any Authorization header the client sent gets leaked.

the configured Basic Auth passthrough from ACLs is untouched, it still sets its own header separately.

Summary by CodeRabbit

• Bug Fixes
  • Prevented incoming authorization credentials from being exposed in proxy responses.
  • Responses now include only configured access-control headers and applicable authentication headers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9120e1af-b104-44bd-9018-e322e0327aae

📥 Commits

Reviewing files that changed from the base of the PR and between c7077a7 and 25cc1ec.

📒 Files selected for processing (1)

• internal/controller/proxy_controller.go

💤 Files with no reviewable changes (1)

• internal/controller/proxy_controller.go

---

📝 Walkthrough

Walkthrough

The proxy controller no longer copies the incoming Authorization header to responses. Response headers now come from ACL configuration, with an early return when ACLs are absent.

Changes

Proxy header handling

Layer / File(s)	Summary
ACL-derived response headers internal/controller/proxy_controller.go	setHeaders stops propagating the incoming Authorization header and applies only ACL-derived headers, including optional Basic Auth. It returns immediately when ACLs are nil.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: stopping client Authorization headers from being forwarded downstream.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Stops leaking client-provided Authorization headers to downstream apps by removing automatic passthrough behavior in the proxy controller’s response-header handling.

Changes:

• Removed forwarding of the incoming request’s Authorization header in setHeaders.
• Kept configured Basic Auth passthrough behavior via ACLs (still explicitly sets its own Authorization response header when configured).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.