base: `
proxyHeaders:
  requestId:
    disabled: true`,
			overlay: `
proxyHeaders:
  requestId:
    disabled: false`,
			result: `
proxyHeaders:
  requestId:
    disabled: false`,
		},
		{
			name: "enabled then disabled",
			base: `
proxyHeaders:
  requestId:
    disabled: false`,
			overlay: `
proxyHeaders:
  requestId:
    disabled: true`,

				Namespace: ns,
				Ports:     ports.All(),
				Service:   "no-headers",
				Subsets: []echo.SubsetConfig{
					{
						Annotations: map[string]string{annotation.ProxyConfig.Name: `
tracing: {}
proxyHeaders:
  forwardedClientCert: SANITIZE
  server:
    disabled: true
  requestId:
    disabled: true
  attemptCount:
    disabled: true
  envoyDebugHeaders:
    disabled: true
  metadataExchangeHeaders:

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- https://github.com/istio/istio/issues/17635
releaseNotes:
  - |
    **Added** a new configuration to `ProxyHeaders`, `MetadataExchangeHeaders`. The `IN_MESH` mode ensures `x-envoy-peer-metadata` and `x-envoy-peer-metadata-id`

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
  - |
    **Added** a new configuration to `ProxyConfig`, `ProxyHeaders`. This allows customization of headers like `server`, `x-forwarded-client-cert`, etc.

	}

	testCases := []struct {
		name          string
		originHeaders http.Header
		proxyHeaders  []apimirror.HTTPHeader
		want          http.Header
	}{
		{
			name: "Only Origin",
			originHeaders: http.Header{
				testHeader: []string{testHeaderValue},
			},
			proxyHeaders: []apimirror.HTTPHeader{},
			want: http.Header{
				testHeader:   []string{testHeaderValue},

func MergeProxyConfig(yaml string, proxyConfig *meshconfig.ProxyConfig) (*meshconfig.ProxyConfig, error) {
	origMetadata := proxyConfig.ProxyMetadata
	origProxyHeaders := proxyConfig.ProxyHeaders
	if err := protomarshal.ApplyYAML(yaml, proxyConfig); err != nil {
		return nil, fmt.Errorf("could not parse proxy config: %v", err)
	}
	newMetadata := proxyConfig.ProxyMetadata

func GetProxyHeaders(node *model.Proxy, push *model.PushContext, class istionetworking.ListenerClass) ProxyHeaders {
	pc := node.Metadata.ProxyConfigOrDefault(push.Mesh.DefaultConfig)
	return GetProxyHeadersFromProxyConfig(pc, class)
}

func GetProxyHeadersFromProxyConfig(pc *meshconfig.ProxyConfig, class istionetworking.ListenerClass) ProxyHeaders {
	base := ProxyHeaders{
		ServerName:                 EnvoyServerName,

	httpProtoOpts := &core.Http1ProtocolOptions{}
	if features.HTTP10 || enableHTTP10(node.Metadata.HTTP10) {
		httpProtoOpts.AcceptHttp_10 = true
	}
	xffNumTrustedHops := uint32(0)

	// Gateways do not use ProxyHeaders for XFCC as there is an existing field in gateway topology that is used instead.
	forwardClientCertDetails := util.MeshConfigToEnvoyForwardClientCertDetails(meshconfig.ForwardClientCertDetails_SANITIZE_SET)

## 🎏 🛠️

📤 📚 🎏 🔫 🛠️.

🖼:

* <a href="https://docs.sentry.io/platforms/python/asgi/" class="external-link" target="_blank">🔫</a>
* <a href="https://github.com/encode/uvicorn/blob/master/uvicorn/middleware/proxy_headers.py" class="external-link" target="_blank">Uvicorn `ProxyHeadersMiddleware`</a>
* <a href="https://github.com/florimondmanca/msgpack-asgi" class="external-link" target="_blank">🇸🇲</a>

For example:

* <a href="https://docs.sentry.io/platforms/python/guides/fastapi/" class="external-link" target="_blank">Sentry</a>
* <a href="https://github.com/encode/uvicorn/blob/master/uvicorn/middleware/proxy_headers.py" class="external-link" target="_blank">Uvicorn's `ProxyHeadersMiddleware`</a>
* <a href="https://github.com/florimondmanca/msgpack-asgi" class="external-link" target="_blank">MessagePack</a>