mux: forward X- headers

[scarlettperry]

Description

Background:
By default, http request headers are passed to gRPC context via the DefaultHeaderMatcher rule. If the request headers don't meet certain preconditions, they are dropped.

Solution:
PR adds a custom header rule so that X- request headers are forwarded (and prefixed with grpcgateway). All other headers will be checked by the DefaultHeaderMatcher rule.

Use case for this change:
For the slackbot work, we need to verify a request came from Slack by certain X- request headers sent in the request.

Testing Performed

Unit test and locally with #1250

[scarlettperry]

RE comment - want to double check that we should append the grpcgateway prefex to the -X headers?

If so, I noticed something interesting locally in which the context metadata list had both grpcgateway-x-forwarded-for and x-forwarded-for. Same situation with x-forwarded-host. This is because if those headers are not found ( which is the case since we're appending a prefix to the header), then it gets added by default here https://github.com/grpc-ecosystem/grpc-gateway/blob/master/runtime/context.go#L121-L134.

Might not be an issue but wanted to raise.

[scarlettperry]

side note: curious about

clutch/backend/middleware/authn/authn.go

Line 101 in 83c47c8

if tokens := md.Get("authorization"); len(tokens) > 0 {

authorization is part of the isPermanentHTTPHeader group, which gets the grpcgateway prefix, so why isn't the lookup grpcgateway-authorization? I ask b/c just want to make sure I'm not missing context that would be important to testing this PR.

• the only thing I can think of is that perhaps the incoming http request is Grpc-Metadata-Authorization which then gets changed to Authorization but didn't find code / docs that mentioned this.

[danielhochman]

re: authorization handling it's right above the other code you linked
https://github.com/grpc-ecosystem/grpc-gateway/blob/0a9acf6a7e6399acd4da6a2d24880bab0390f233/runtime/context.go#L102-L105

for X-Forwarded-For and X-Forwarded-Host is the result just that it will get appended twice, once with once without prefix if passed in by caller? alternatively i guess you could exclude those to avoid confusion.

[scarlettperry]

re: authorization handling it's right above the other code you linked
https://github.com/grpc-ecosystem/grpc-gateway/blob/0a9acf6a7e6399acd4da6a2d24880bab0390f233/runtime/context.go#L102-L105

for X-Forwarded-For and X-Forwarded-Host is the result just that it will get appended twice, once with once without prefix if passed in by caller? alternatively i guess you could exclude those to avoid confusion.

ah got it, thanks!

yep will get appended 2x, so list will have prefix-x-forwarded-for, x-forwarded-for, prefix-x-forwarded-host, x-forwarded-host. Okay will exclude these 2 from getting the prefix to avoid confusion.

[danielhochman]

lgtm! 🚢