Re: user_auth header striping whith squid?

Lothar Gramelspacher wrote:

> We are looking for a way to remove the proxy_auth passwords from the
> http header of any outgoing http packet. We need this to avoid leeking
> passwords out to the internet, because under certain circumstances a
> firewall does not remove the proxy_autch and sends this information to
> the destination server. This is a bug in the firewallsoftware and we are
> looking for a workaround to filter these fields out of the header.

Sounds like a job for the anonymizer features in Squid.

anonymize_header deny Proxy-Authorization

--
Henrik Nordstrom
Spare time Squid hacker