Class ForwardedHeaders

Namespace

Virtufin.Api.Services

Assembly

Virtufin.Api.dll

The allow-list of request headers the gateway propagates to a backend on a proxied call, and the filters that apply it.

public static class ForwardedHeaders

Inheritance

object

ForwardedHeaders

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

An allow-list on purpose. Gateway.Invoke/InvokeJson used to snapshot every inbound header and replay it downstream, which handed the gateway's own x-api-key — the credential guarding the ingress — to every backend on every proxied call, crossing the trust boundary that key exists to defend. Backends authenticate to the gateway with their own key and must never receive the caller's.

Shared by the gRPC and HTTP entry points so the two cannot drift: the gRPC path forwarded everything while its POST /v1/grpc/call twin forwarded nothing at all, silently ignoring the metadata field callers were passing it.

Methods

From(Metadata)

Projects inbound gRPC request headers to the subset safe to forward.

public static Dictionary<string, string> From(Metadata headers)

Parameters

headers Metadata

Returns

Dictionary<string, string>

Remarks

Binary (-bin) entries are skipped rather than read: Value throws InvalidOperationException on a binary entry, and Metadata.Add(key, string) throws ArgumentException for a -bin key. Reading them unconditionally meant any client sending one got an opaque INTERNAL error and could never use Invoke at all.

From(IReadOnlyDictionary<string, string>?)

Projects a caller-supplied metadata map (the HTTP POST /v1/grpc/call body's metadata field) to the subset safe to forward.

public static Dictionary<string, string>? From(IReadOnlyDictionary<string, string>? metadata)

Parameters

metadata IReadOnlyDictionary<string, string>

Returns

Dictionary<string, string>

Remarks

These values come from a request body rather than transport metadata, so a caller can set any of them freely. That is acceptable for exactly this allow-list — tracing and correlation identifiers, which a REST caller has no other way to propagate, and which carry no authority. Do not widen it to anything a backend would trust for authentication or authorization.

IsAllowed(string)

True if header may be forwarded downstream.

public static bool IsAllowed(string header)

Parameters

header string

Returns

bool