Security
- Proxy middleware: a client could remove
X-Forwarded-Protofrom the upstream request by naming it in theConnectionheader, on plain HTTP requests and WebSocket upgrades. The proxy now setsX-Forwarded-Protoagain after Go removes hop-by-hop headers, as it already does forX-Real-IP. Fixes GHSA-h6x5-phvw-c55c. Reported by zachary-satterly.
Behavior change
A custom balancer that replaces the request and sets its own X-Forwarded-Proto no longer reaches the upstream with that value; the proxy uses the scheme of the original request. A custom ProxyConfig.Transport can still set the header.
No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.