Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

<@U04UQ68083H> With Oathkeeper, how can I delete a specific request header by default? For example to prevent that `X-User` is only set by oathkeeper but deleted if I forgot to specify the header mutator.

I apologize, but based on the provided knowledge sources, there is not enough specific information to answer how to delete a specific request header by default in Oathkeeper, such as preventing `X-User` from being set if you forget to specify the header mutator.  The knowledge sources contain information about various Oathkeeper components and configurations, including mutators like the header mutator [Oathkeeper Mutators](<https://www.ory.sh/docs/oathkeeper/pipeline/mutator#header>), but they do not provide details on how to delete specific headers by default or prevent certain headers from being set automatically.  To get an accurate answer to your specific question, you may need to consult the official Ory Oathkeeper documentation or reach out to their support channels for more detailed information on header management and default behaviors.