From 74c55d9656b46e3c2e673385038d68b312eee3c3 Mon Sep 17 00:00:00 2001 From: "lijiacheng.ljc" Date: Thu, 27 Jul 2023 16:00:42 +0800 Subject: [PATCH] Update README --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index 6a51434a..9d3d9a57 100644 --- a/README.md +++ b/README.md @@ -160,6 +160,13 @@ public internet, consider tuning it appropriately: logging using [zerolog] and further hardens the HTTP server against malicious clients by tuning lower-level timeouts and limits. +5. **Prevent leaking sensitive headers** + + By default, go-httpbin will return any headers sent by the client in the response. + But if you want to deploy go-httpbin in some serverless environment, you may want to drop some headers. + You can use the `-exclude-headers` CLI argument or the `EXCLUDE_HEADERS` env var to configure an appropriate allowlist. + For example, Alibaba Cloud Function Compute will [add some headers like `x-fc-*` to the request](https://www.alibabacloud.com/help/en/fc/user-guide/specification-details). if you want to drop these `x-fc-*` headers, you can set `EXCLUDE_HEADERS=x-fc-*`. + ## Development ```bash