Filter request- or response-headers with VMOD re2 sets

Filter request- or response-headers with VMOD re2 sets ¶ Why filter headers at all? ¶ When we care about security, less is often more. If we avoid malicious headers reaching backends, they can not be used to exploit security issues. In general, there is a denylist and an allowlist approach. Both can be efficiently implemented using vmod_re2 . The denylist approach is (way) less secure, but used by most commercial WAFs and CDNs with WAF-features, because it needs less customization. The allowlist approach is