feat: enhance header management in dynamic proxy

- Add support for custom request header removal and mapping in `DynamicProxyGlobalFilter`.
- Extend `DynamicProxyProperties` to include `removedRequestHeaders` and `requestHeaderMappings`.
- Implement logic to apply header mappings and removal in `withDownstreamHeaders`.
- Update integration tests to verify header handling functionality.
- Add unit tests for `DynamicProxyProperties` binding.

Author: CoderYellow

autoconfigure/src/main/kotlin/org/openprojectx/spring/cloud/proxy/autoconfigure/DynamicProxyGlobalFilter.kt

@@ -19,14 +19,45 @@ internal class DynamicProxyGlobalFilter(
         val prefix = properties.normalizedPrefix()
         if (path != prefix && !path.startsWith("$prefix/")) return chain.filter(exchange)
 
-        val destination = try {
-            destination(path, exchange.request.uri.rawQuery)
+        val destination: URI
+        val downstreamExchange: ServerWebExchange
+        try {
+            destination = destination(path, exchange.request.uri.rawQuery)
+            downstreamExchange = withDownstreamHeaders(exchange)
         } catch (exception: IllegalArgumentException) {
             return badRequest(exchange, exception.message ?: "Invalid dynamic proxy destination")
         }
 
-        exchange.attributes[GATEWAY_REQUEST_URL_ATTR] = destination
-        return chain.filter(exchange)
+        downstreamExchange.attributes[GATEWAY_REQUEST_URL_ATTR] = destination
+        return chain.filter(downstreamExchange)
+    }
+
+    private fun withDownstreamHeaders(exchange: ServerWebExchange): ServerWebExchange {
+        val mappings = properties.requestHeaderMappings.onEach { mapping ->
+            require(mapping.source.isNotBlank() && mapping.target.isNotBlank()) {
+                "Request header mapping source and target must not be blank"
+            }
+        }
+
+        val request = exchange.request.mutate().headers { headers ->
+            // Capture mapped values first so a source can also appear in removedRequestHeaders.
+            val mappedValues = mappings.map { mapping -> mapping to headers.getValuesAsList(mapping.source).toList() }
+
+            properties.removedRequestHeaders.forEach { header ->
+                require(header.isNotBlank()) { "Removed request header names must not be blank" }
+                headers.remove(header)
+            }
+
+            mappedValues.forEach { (mapping, values) ->
+                headers.remove(mapping.source)
+                if (values.isNotEmpty()) {
+                    headers.remove(mapping.target)
+                    headers.addAll(mapping.target, values)
+                }
+            }
+        }.build()
+
+        return exchange.mutate().request(request).build()
     }
 
     private fun destination(path: String, rawQuery: String?): URI {

autoconfigure/src/main/kotlin/org/openprojectx/spring/cloud/proxy/autoconfigure/DynamicProxyProperties.kt

@@ -10,4 +10,15 @@ data class DynamicProxyProperties(
     var pathPrefix: String = "/dynamic-proxy",
     /** URI schemes that callers may select. */
     var allowedSchemes: Set<String> = setOf("http", "https"),
+    /** Request headers that must never be forwarded to the dynamic destination. */
+    var removedRequestHeaders: Set<String> = setOf("Authorization", "Cookie"),
+    /** Headers that carry destination-specific values under a different public name. */
+    var requestHeaderMappings: List<RequestHeaderMapping> = listOf(
+        RequestHeaderMapping("X-Target-Authorization", "Authorization"),
+    ),
+)
+
+data class RequestHeaderMapping(
+    var source: String = "",
+    var target: String = "",
 )

autoconfigure/src/test/kotlin/org/openprojectx/spring/cloud/proxy/autoconfigure/DynamicProxyIntegrationTest.kt

@@ -7,6 +7,7 @@ import org.springframework.boot.SpringBootConfiguration
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration
 import org.springframework.boot.test.context.SpringBootTest
 import org.springframework.boot.test.web.server.LocalServerPort
+import org.springframework.http.HttpHeaders
 import org.springframework.http.MediaType
 import org.springframework.test.web.reactive.server.WebTestClient
 import org.testcontainers.containers.GenericContainer
@@ -36,7 +37,12 @@ class DynamicProxyIntegrationTest {
                 "method": "POST",
                 "urlPath": "/target%20host-api/nested",
                 "queryParameters": { "q": { "equalTo": "spring cloud" } },
-                "headers": { "X-Proxy-Test": { "equalTo": "forwarded" } },
+                "headers": {
+                  "X-Proxy-Test": { "equalTo": "forwarded" },
+                  "Authorization": { "equalTo": "Bearer target-credential" },
+                  "Cookie": { "absent": true },
+                  "X-Target-Authorization": { "absent": true }
+                },
                 "bodyPatterns": [{ "equalToJson": { "hello": "gateway" } }]
               },
               "response": {
@@ -66,6 +72,9 @@ class DynamicProxyIntegrationTest {
                     .build()
             }
             .header("X-Proxy-Test", "forwarded")
+            .header(HttpHeaders.AUTHORIZATION, "Bearer proxy-credential")
+            .header(HttpHeaders.COOKIE, "proxy-session=secret")
+            .header("X-Target-Authorization", "Bearer target-credential")
             .contentType(MediaType.APPLICATION_JSON)
             .bodyValue("""{"hello":"gateway"}""")
             .exchange()

autoconfigure/src/test/kotlin/org/openprojectx/spring/cloud/proxy/autoconfigure/DynamicProxyPropertiesTest.kt

@@ -0,0 +1,31 @@
+package org.openprojectx.spring.cloud.proxy.autoconfigure
+
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import org.springframework.boot.context.properties.bind.Bindable
+import org.springframework.boot.context.properties.bind.Binder
+import org.springframework.boot.context.properties.source.MapConfigurationPropertySource
+
+class DynamicProxyPropertiesTest {
+
+    @Test
+    fun `binds custom removed headers and header mappings`() {
+        val source = MapConfigurationPropertySource(
+            mapOf(
+                "spring.cloud.proxy.dynamic.removed-request-headers[0]" to "X-Internal-Token",
+                "spring.cloud.proxy.dynamic.removed-request-headers[1]" to "X-User-Session",
+                "spring.cloud.proxy.dynamic.request-header-mappings[0].source" to "X-Target-Token",
+                "spring.cloud.proxy.dynamic.request-header-mappings[0].target" to "X-Api-Token",
+            ),
+        )
+
+        val properties = Binder(source)
+            .bind("spring.cloud.proxy.dynamic", Bindable.of(DynamicProxyProperties::class.java))
+            .get()
+
+        assertThat(properties.removedRequestHeaders)
+            .containsExactly("X-Internal-Token", "X-User-Session")
+        assertThat(properties.requestHeaderMappings)
+            .containsExactly(RequestHeaderMapping("X-Target-Token", "X-Api-Token"))
+    }
+}