From 44c8a0431b2a4d195a7e9983b741dc2532a94b72 Mon Sep 17 00:00:00 2001 From: Simon Kassing Date: Mon, 20 Jul 2026 14:41:56 +0200 Subject: [PATCH] pipeline-manager: filter further forwarded pipeline streaming headers The `authorization` header has already been handled by the API server, and thus does not need to be included in the headers sent to the pipeline. Signed-off-by: Simon Kassing --- crates/pipeline-manager/src/runner/interaction.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crates/pipeline-manager/src/runner/interaction.rs b/crates/pipeline-manager/src/runner/interaction.rs index e8819d78361..1d3d8e94fac 100644 --- a/crates/pipeline-manager/src/runner/interaction.rs +++ b/crates/pipeline-manager/src/runner/interaction.rs @@ -612,10 +612,12 @@ pub(crate) async fn streaming_proxy( // compression causes gzip frame buffering that blocks streaming clients (see the // `Content-Encoding: identity` override below). `.no_decompress()` above suppresses // awc's own `Accept-Encoding` header; here we also strip the client's. + // `authorization` has already been handled by the API server, and is thus not needed + // to be forwarded to the pipeline itself. for header in request .headers() .into_iter() - .filter(|(h, _)| *h != "connection" && *h != "accept-encoding") + .filter(|(h, _)| *h != "connection" && *h != "accept-encoding" && *h != "authorization") { new_request = new_request.append_header(header); }