Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/middleware/headers.go

@@ -53,6 +53,11 @@ func flattenHeaders(headers http.Header) {
 func stripHeaders(headers []options.Header, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		for _, header := range headers {
+			if header.InsecureSkipHeaderNormalization {
+				req.Header.Del(header.Name)
+				continue
+			}
+
 			stripNormalizedHeader(req, header)
 		}
 		next.ServeHTTP(rw, req)

pkg/middleware/headers_test.go

@@ -205,7 +205,7 @@ var _ = Describe("Headers Suite", func() {
 			expectedHeaders: nil,
 			expectedErr:     "error building request header injector: error building request injector: error building injector for header \"X-Auth-Request-Authorization\": error loading basicAuthPassword: secret source is invalid: exactly one entry required, specify either value, fromEnv or fromFile",
 		}),
-		Entry("strips normalized variants before injecting (no preservation)", headersTableInput{
+		Entry("strips normalized variants before injecting", headersTableInput{
 			headers: []options.Header{
 				{
 					Name: "X-Auth-Request-User",
@@ -226,6 +226,29 @@ var _ = Describe("Headers Suite", func() {
 			},
 			expectedErr: "",
 		}),
+		Entry("doesn't strip normalized variants before injecting", headersTableInput{
+			headers: []options.Header{
+				{
+					Name:                            "X-Auth-Request-User",
+					InsecureSkipHeaderNormalization: true,
+					Values: []options.HeaderValue{
+						{
+							ClaimSource: &options.ClaimSource{Claim: "user"},
+						},
+					},
+				},
+			},
+			initialHeaders: http.Header{
+				"X-Auth-Request-User": []string{"old"},
+				"X-Auth_Request_User": []string{"evil"},
+			},
+			session: &sessionsapi.SessionState{User: "user-123"},
+			expectedHeaders: http.Header{
+				"X-Auth-Request-User": []string{"user-123"},
+				"X-Auth_Request_User": []string{"evil"},
+			},
+			expectedErr: "",
+		}),
 	)
 
 	DescribeTable("the response header injector",