<p>Is there any way to remove a header going upstream after the external authentication with the envoy proxy? We planned to migrate to envoy proxy for our internal API gateway, but this is a blocker now.</p>

<p>For example: the external authentication service gets the request and processes the authentication header, in case the validation fails, it throws the 401. But if it succeeds, I want to prevent the auth headers from going upstream. </p>

<p>As per the documentation <a href="https://www.envoyproxy.io/docs/envoy/v1.9.0/api-v2/config/filter/http/ext_authz/v2alpha/ext_authz.proto#envoy-api-msg-config-filter-http-ext-authz-v2alpha-httpservice" rel="noreferrer">Ext Auth</a>:</p>

<blockquote>
  <p>A successful check allows the authorization service adding or overriding headers from the original request before dispatching it to the upstream. This is done by configuring which headers in the authorization response should be sent to the upstream. See allowed_authorization_headers below.</p>
</blockquote>

<p>There is no mention whether I can completely remove the header going upstream. </p>

<p>I have the option to override the headers, but that is causing header conflict at the upstream servers. So it is not a possible solution.</p>

<p>How can I achieve this?</p>

<p>What about using the <code>route</code> level option <code>request_headers_to_remove</code> to remove an <em><strong>Authorization</strong></em> header?</p>
<p>See <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto" rel="nofollow noreferrer">https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto</a></p>
