taytay / api-proxy-3scale-heroku Goto Github PK

The X-3scale-Proxy-Secret-Token header is being added to talk to the upstream server to protect the public api endpoint (my server). I understand that from reading https://support.3scale.net/howtos/api-configuration/nginx-proxy-advanced and a bit of networking background. In my server, I remove the X-3scale-Proxy-Secret-Token header in any of the responses back to the api-proxy-3scale-heroku, but the proxy keeps the secret header when passing the response back to the caller.

When I curl -v -X Get "http://myapi.mydomain.com", I don't want it to respond with the secret token header, ever.

Am I doing something wrong, or is this is a flaw in the api-proxy-3scale-heroku configuration here? I'm pretty new to nginx, so I may just need some help.

Thanks.