Support Envoy ext_authz raw header encoding

[dadrus]

Preflight checklist

• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines."
• I have discussed this feature request with the community.

Describe the background of your feature request

Envoy's gRPC ext_authz integration can provide request headers using header_map when encode_raw_headers is enabled instead of using the regular headers map.

heimdall's Envoy gRPC integration currently only processes the latter representation. As a result, enabling encode_raw_headers would prevent request headers from being handled correctly in several places, including request context creation, client IP extraction, access logging and trusted proxy handling.

Describe your idea

Support both header representations provided by Envoy's gRPC ext_authz API.

Header handling should be normalized internally so that the rest of heimdall does not need to distinguish between headers and header_map.

This should include at least:

• request header access
• cookie and content type handling
• client IP extraction
• access logging
• trusted proxy sanitization

Are there any workarounds or alternatives?

Keep encode_raw_headers disabled in Envoy.

This is currently also what the documented Envoy-based integrations effectively rely on.

Version

0.17.20

Additional Context

Envoy recommends encode_raw_headers: true since the option was introduced in Envoy 1.30.0 (April 2024), while keeping it disabled by default for backwards compatibility.

However, none of the Envoy-based integrations currently documented by heimdall was found to enable encode_raw_headers by default. The request is therefore primarily about supporting the complete Envoy gRPC ext_authz header model and avoiding incompatibilities with configurations that enable raw header encoding.