From f61e6c1cd491f3f63ce9d0162b6eda88aa8d293e Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Wed, 12 Aug 2026 15:34:48 -0400
Subject: [PATCH] Pull the downstream headers from the comfig if provided

---
 main.go | 56 ++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 44 insertions(+), 12 deletions(-)

diff --git a/main.go b/main.go
index 7baa947..45b4be5 100644
--- a/main.go
+++ b/main.go
@@ -24,6 +24,12 @@ type Config struct {
 	TrustIP                     []string `json:"trustip,omitempty"`
 	DisableDefaultCFIPs         bool     `json:"disableDefaultCFIPs,omitempty"`
 	CustomIPHeader              string   `json:"customIPHeader,omitempty"`
+	RemoteUserIDHeader          string   `json:"remoteUserIdHeader,omitempty"`
+	RemoteVirtualApiKeyIDHeader string   `json:"remoteVirtualApiKeyIdHeader,omitempty"`
+	RemoteUserHeader            string   `json:"remoteUserHeader,omitempty"`
+	RemoteEmailHeader           string   `json:"remoteEmailHeader,omitempty"`
+	RemoteNameHeader            string   `json:"remoteNameHeader,omitempty"`
+	RemoteRoleHeader            string   `json:"remoteRoleHeader,omitempty"`
 }
 
 const (
@@ -32,6 +38,13 @@ const (
 	xForwardProto  = "X-Forwarded-Proto"
 	cfConnectingIP = "CF-Connecting-IP"
 	cfVisitor      = "CF-Visitor"
+
+	defaultRemoteUserIDHeader          = "Remote-User-Id"
+	defaultRemoteVirtualApiKeyIDHeader = "Remote-Virtual-Api-Key-Id"
+	defaultRemoteUserHeader            = "Remote-User"
+	defaultRemoteEmailHeader           = "Remote-Email"
+	defaultRemoteNameHeader            = "Remote-Name"
+	defaultRemoteRoleHeader            = "Remote-Role"
 )
 
 type Badger struct {
@@ -46,6 +59,19 @@ type Badger struct {
 	disableForwardAuth          bool
 	trustIP                     []*net.IPNet
 	customIPHeader              string
+	remoteUserIDHeader          string
+	remoteVirtualApiKeyIDHeader string
+	remoteUserHeader            string
+	remoteEmailHeader           string
+	remoteNameHeader            string
+	remoteRoleHeader            string
+}
+
+func stringOrDefault(value, def string) string {
+	if value == "" {
+		return def
+	}
+	return value
 }
 
 type VerifyBody struct {
@@ -116,6 +142,12 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		accessTokenHeader:           config.AccessTokenHeader,
 		disableForwardAuth:          config.DisableForwardAuth,
 		customIPHeader:              config.CustomIPHeader,
+		remoteUserIDHeader:          stringOrDefault(config.RemoteUserIDHeader, defaultRemoteUserIDHeader),
+		remoteVirtualApiKeyIDHeader: stringOrDefault(config.RemoteVirtualApiKeyIDHeader, defaultRemoteVirtualApiKeyIDHeader),
+		remoteUserHeader:            stringOrDefault(config.RemoteUserHeader, defaultRemoteUserHeader),
+		remoteEmailHeader:           stringOrDefault(config.RemoteEmailHeader, defaultRemoteEmailHeader),
+		remoteNameHeader:            stringOrDefault(config.RemoteNameHeader, defaultRemoteNameHeader),
+		remoteRoleHeader:            stringOrDefault(config.RemoteRoleHeader, defaultRemoteRoleHeader),
 	}
 
 	// Validate required fields only if forward auth is enabled
@@ -284,12 +316,12 @@ func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	req.Header.Del("Remote-User")
-	req.Header.Del("Remote-Email")
-	req.Header.Del("Remote-Name")
-	req.Header.Del("Remote-Role")
-	req.Header.Del("Remote-User-Id")
-	req.Header.Del("Remote-Virtual-Api-Key-Id")
+	req.Header.Del(p.remoteUserHeader)
+	req.Header.Del(p.remoteEmailHeader)
+	req.Header.Del(p.remoteNameHeader)
+	req.Header.Del(p.remoteRoleHeader)
+	req.Header.Del(p.remoteUserIDHeader)
+	req.Header.Del(p.remoteVirtualApiKeyIDHeader)
 
 	if result.Data.ResponseHeaders != nil {
 		for key, value := range result.Data.ResponseHeaders {
@@ -332,27 +364,27 @@ func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		}
 
 		if result.Data.UserId != nil {
-			req.Header.Add("Remote-User-Id", *result.Data.UserId)
+			req.Header.Add(p.remoteUserIDHeader, *result.Data.UserId)
 		}
 
 		if result.Data.Username != nil {
-			req.Header.Add("Remote-User", *result.Data.Username)
+			req.Header.Add(p.remoteUserHeader, *result.Data.Username)
 		}
 
 		if result.Data.Email != nil {
-			req.Header.Add("Remote-Email", *result.Data.Email)
+			req.Header.Add(p.remoteEmailHeader, *result.Data.Email)
 		}
 
 		if result.Data.Name != nil {
-			req.Header.Add("Remote-Name", *result.Data.Name)
+			req.Header.Add(p.remoteNameHeader, *result.Data.Name)
 		}
 
 		if result.Data.Role != nil {
-			req.Header.Add("Remote-Role", *result.Data.Role)
+			req.Header.Add(p.remoteRoleHeader, *result.Data.Role)
 		}
 
 		if result.Data.VirtualApiKeyId != nil {
-			req.Header.Add("Remote-Virtual-Api-Key-Id", *result.Data.VirtualApiKeyId)
+			req.Header.Add(p.remoteVirtualApiKeyIDHeader, *result.Data.VirtualApiKeyId)
 		}
 
 		if !result.Data.DontStripSession {