}
				errs = appendErrors(errs, ValidateHTTPHeaderNameOrJwtClaimRoute(name))
				errs = appendErrors(errs, validateStringMatch(header, "headers"))
			}

			for name, header := range match.WithoutHeaders {
				errs = appendErrors(errs, ValidateHTTPHeaderNameOrJwtClaimRoute(name))
				// `*` is NOT a RE2 style regex, it will be translated as present_match.

	}
	if !validHeaderRegex.MatchString(name) {
		return fmt.Errorf("header name %s is not a valid header name", name)
	}
	return nil
}

// ValidateHTTPHeaderNameOrJwtClaimRoute validates a header name, allowing special @request.auth.claims syntax
func ValidateHTTPHeaderNameOrJwtClaimRoute(name string) error {
	if name == "" {
		return fmt.Errorf("header name cannot be empty")
	}
	if jwt.ToRoutingClaim(name).Match {