Hop-by-hop abuse to malform header mutator
ImpactDownstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:The `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.Patchesc5cc7f736dc84185034be4356057d1c7a656d797WorkaroundsThe downstream server should handle the case that an expected header is not set by responding with an appropriate error.ReferencesSee background info in https://github.com/golang/go/issues/50580