Open pipeline opened 3 years ago
Ran into this same issue with glorp proxy (https://github.com/denandz/glorp/issues/23) - the underlying net/http
library used by both goproxy and martian cannonicalizes headers as they're get/set from the header map (https://go.dev/src/net/http/header.go?s=1433:1473)
A solution would need to figure out a way around this Golang net/http
logic :-/
We currently have work underway on a new library for proxying which doesn't rely on Golang's HTTP implementation. A technical proof of concept is in progress, but we don't necessarily have any timeframes.
The underlying proxy library (elazarl/goproxy) and internal functions use the golang representation of HTTP requests/responses. These have limitations, and in particular header order (and likely capitilisation) is not maintained.
This may cause some issues where vulnerabilities cannot be tested for, or it may create confusion.
If practical, fixes should be provided upstream to the elazarl/goproxy library, or a fork should be maintained.