{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-gateway/issues/703","repository_url":"https://api.github.com/repos/spring-cloud/spring-cloud-gateway","labels_url":"https://api.github.com/repos/spring-cloud/spring-cloud-gateway/issues/703/labels{/name}","comments_url":"https://api.github.com/repos/spring-cloud/spring-cloud-gateway/issues/703/comments","events_url":"https://api.github.com/repos/spring-cloud/spring-cloud-gateway/issues/703/events","html_url":"https://github.com/spring-cloud/spring-cloud-gateway/issues/703","id":389339973,"node_id":"MDU6SXNzdWUzODkzMzk5NzM=","number":703,"title":"Sensitive Headers are Forwarded in SCG 2.1.0","user":{"login":"wtatum","id":7574197,"node_id":"MDQ6VXNlcjc1NzQxOTc=","avatar_url":"https://avatars3.githubusercontent.com/u/7574197?v=4","gravatar_id":"","url":"https://api.github.com/users/wtatum","html_url":"https://github.com/wtatum","followers_url":"https://api.github.com/users/wtatum/followers","following_url":"https://api.github.com/users/wtatum/following{/other_user}","gists_url":"https://api.github.com/users/wtatum/gists{/gist_id}","starred_url":"https://api.github.com/users/wtatum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wtatum/subscriptions","organizations_url":"https://api.github.com/users/wtatum/orgs","repos_url":"https://api.github.com/users/wtatum/repos","events_url":"https://api.github.com/users/wtatum/events{/privacy}","received_events_url":"https://api.github.com/users/wtatum/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-10T14:59:16Z","updated_at":"2018-12-10T14:59:16Z","closed_at":null,"author_association":"NONE","body":"### Description\r\n\r\nIn Spring Cloud Gateway 2.1.0.M3, sensitive headers `Authorization` and `Cookie` are forwarded from source requests to downstream systems.\r\n\r\n### Expected Behavior\r\n\r\nPer documentation:\r\n\r\n> First class support is provided for \"sensitive\" headers (\"cookie\" and \"authorization\" by default) which are not passed downstream, and for \"proxy\" headers (x-forwarded-*).\r\n\r\n### Actual Behavior\r\n\r\nBoth headers are forwarded.\r\n\r\n![image](https://user-images.githubusercontent.com/7574197/49740313-ec393700-fc61-11e8-9a71-3f07751c2c8d.png)\r\n\r\n### Steps to Reproduce\r\n\r\n- Clone the minimal reproduction at https://github.com/wtatum/scg-sensitive\r\n- Build and run with Maven from /scg-sensitive-gateway\r\n- Test GET localhost:8080/bin/get or POST localhost:8080/bin/post to get an echo from httpbin\r\n- `Cookie: SESSION=...` is included\r\n- If supplied, `Authorization` is included."}}
{"actor":{"display_login":"wtatum"}}