id: http-sanitize-headers-basic
name: Sanitize risky forwarding headers
protocol: http
description: Removes a few risky forwarding headers before the request is sent upstream.
category: http
family: web-hardening
tags:
- rewrite
- headers
- web
action: rewrite
summary: Removes a few risky forwarding headers before the request is sent upstream.
behavior: Deletes selected override or forwarding headers and logs what was rewritten
  without blocking the request.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import http

  STRIP_HEADERS = (
      "x-forwarded-host",
      "x-http-method-override",
      "x-original-url",
      "x-rewrite-url",
  )


  def request(flow: http.HTTPFlow) -> None:
      removed = []
      for header in STRIP_HEADERS:
          if header in flow.request.headers:
              removed.append(header)
              del flow.request.headers[header]
      if removed:
          logging.info(
              "[http-sanitize-headers-basic] stripped headers=%s url=%s",
              ",".join(removed),
              flow.request.pretty_url,
          )