Alexander Yastrebov

As a workaround for now you may consider using [RouteGroup CRD](https://github.com/zalando/skipper/blob/master/docs/kubernetes/routegroups.md#backends) with a network backend instead of ExtrenalName service.

Couple of thoughts: * Filter name is generic and implies normalization but it only does duplicate slash elimination * Link to Zalando Guidelines mentions https://en.wikipedia.org/wiki/URI_normalization which mentions [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) which...

The thing is that go http.Server does not put "Host" into http.Request.Header but sets http.Request.Host, see https://pkg.go.dev/net/http#Request > // For incoming requests, the Host header is promoted to the >...

> Should not we better "fix" the setRequestHeader("Host", ..) part? Yeah, I think we can also set `ctx.Request().Host`. > One open question of course is, if this result in an...

Looks like duplicate of https://github.com/zalando/skipper/issues/1604

I think I changed bearerinjector docs within https://github.com/zalando/skipper/pull/2740 to say its a special form of setRequestHeaderFromSecret which has all links and usage examples.

> It is probably easier to just base64url-encode or add `-_` to the alphabet to make its length a power of 2.

> This behaviour is well-suited to API traffic, but doesn't work for frontend traffic where the user agent should be redirected upon rejection. I can see the point, e.g. if...

> > Incidental: Prevent the webhook client from following redirects from the AuthN/AuthZ endpoint: during testing I realised that the default net/http behaviour was in use - i.e. redirects were...

We may also expose corresponding error message per invalid route.