Hello, I was wondering if oathkeeper can remove headers from an incoming request, from the documentation you can add headers through the

header

mutator but can we remove them ?

Some specific, like authorization or cookies?

to avoid header forgery we would like to drop the header on incoming requets, so that only oathkeeper can set it during the mutators and to ensure that if the header is present it must be from oathkeeper and it can be trusted

If you setup the same header name, it should overwrite the existing (incoming) header

thanks I'll try that