From 704a874e84667e6553ce58e995e8530f4ac15291 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Thu, 3 Nov 2016 12:04:58 +0000 Subject: [PATCH] Add example of empty sensitive headers Emphasises that it's a black list, and clarifies that you need to set it to empty to get authorization and cookie headers. --- .../main/asciidoc/spring-cloud-netflix.adoc | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-netflix.adoc b/docs/src/main/asciidoc/spring-cloud-netflix.adoc index 129b47dd..5efb3857 100644 --- a/docs/src/main/asciidoc/spring-cloud-netflix.adoc +++ b/docs/src/main/asciidoc/spring-cloud-netflix.adoc @@ -1470,13 +1470,29 @@ route, e.g. url: https://downstream ---- -Sensitive headers can also be set globally by setting `zuul.sensitiveHeaders`. If `sensitiveHeaders` is set on a route, this will override the global `sensitiveHeaders` setting. - NOTE: this is the default value for `sensitiveHeaders`, so you don't need to set it unless you want it to be different. N.B. this is new in Spring Cloud Netflix 1.1 (in 1.0 the user had no control over headers and all cookies flow in both directions). +The `sensitiveHeaders` are a blacklist and the default is not empty, +so to make Zuul send all headers (except the "ignored" ones) you would +have to explicitly set it to the empty list. This is necessary if you +want to pass cookie or authorization headers to your back end. Example: + +.application.yml +[source,yaml] +---- + zuul: + routes: + users: + path: /myusers/** + sensitiveHeaders: + url: https://downstream +---- + +Sensitive headers can also be set globally by setting `zuul.sensitiveHeaders`. If `sensitiveHeaders` is set on a route, this will override the global `sensitiveHeaders` setting. + === Ignored Headers In addition to the per-route sensitive headers, you can set a global