Request/response header handling for the native relay.
Hop-by-hop fields (RFC 9110 section 7.6.1, plus any named by connection)
are removed in both directions. Caller credentials and proxy identity fields
(authorization, proxy-authorization, cookie, forwarded,
x-forwarded-*, x-real-ip) are never forwarded to the backend; the backend
only sees the gateway's own connection identity. host is set by the
backend connection. Every other end-to-end field, including duplicates and
x-incus-* fields, is forwarded unchanged.
Summary
Functions
Filter caller headers for the backend and choose the request body framing.
Validate and filter backend response headers (or trailers) for the caller.
Returns {:ok, headers} or :error for a field that could inject or
smuggle a response.
Trailer fields that must never appear after a body.
Functions
Filter caller headers for the backend and choose the request body framing.
Returns {:ok, headers, body} where body is :none, {:length, n} or
:chunked, or {:error, failure} before any backend contact.
Validate and filter backend response headers (or trailers) for the caller.
Returns {:ok, headers} or :error for a field that could inject or
smuggle a response.
Trailer fields that must never appear after a body.