title: How to stop HAProxy from stripping auth header
body: <p>So I'm having an issue with HAProxy stripping the authorization header from from my call when redirecting to a separate URL. Specifically, I want to hit an AWS lambda, based on the URL path. </p>
  
  <p>subdomain.domain/mo/api should be routed to the lambda, and it is based on this configuration, but I receive this response back from the lambda (using postman):</p>
  
  <p>{
    "message": "Missing Authentication Token"
  }</p>
  
  <p>hitting the lambda url (bypassing HAProxy) works as expected, all headers are exactly the same.</p>
  
  <p>Proxy config:</p>
  
  <pre><code>global
  
      log /dev/log    local0
      log /dev/log    local1 notice
      maxconn 20000
      chroot /var/lib/haproxy
      stats socket /run/haproxy/admin.sock mode 660 level admin
      stats timeout 30s
      user haproxy
      group haproxy
      daemon
      tune.ssl.default-dh-param 2048
  
      # Default SSL material locations
      ca-base /etc/ssl/certs
      crt-base /etc/ssl/private
  
      ssl-default-bind-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
      ssl-default-bind-options no-sslv3 no-tls-tickets
      ssl-default-server-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
      ssl-default-server-options no-sslv3 no-tls-tickets
  
  defaults
      log     global
      mode    http
      option  httplog
      option  dontlognull
      option forwardfor
      monitor-uri /index.html
      stats enable
      stats uri /stats
      stats realm Haproxy\ Statistics
      timeout connect 5000
      timeout client  50000
      timeout server  50000
      errorfile 400 /etc/haproxy/errors/400.http
      errorfile 403 /etc/haproxy/errors/403.http
      errorfile 408 /etc/haproxy/errors/408.http
      errorfile 500 /etc/haproxy/errors/500.http
      errorfile 502 /etc/haproxy/errors/502.http
      errorfile 503 /etc/haproxy/errors/503.http
      errorfile 504 /etc/haproxy/errors/504.http
  
  frontend http
    bind *:80
  #Defining ACL based on a string in URI
    acl dm_in_uri path_sub dm
    acl mo_in_uri path_sub mo
    acl lab_host hdr(host) -i subdomain.domain.com
    reqadd X-Forwarded-Proto:\ http
  #Special route which matches both hostname and string acl
    use_backend lab_mo_api if lab_host mo_in_uri api_in_uri
    use_backend lab_portal if lab_host
  
  frontend https
    bind *:443 ssl crt /etc/ssl/&lt;blah&gt;.pem
  #Defining ACL based on a string in URI
    acl api_in_uri path_sub api
    acl dm_in_uri path_sub dm
    acl mo_in_uri path_sub mo
    acl lab_host hdr(host) -i subdomain.domain.com
    reqadd X-Forwarded-Proto:\ https
  #Special route which matches both hostname and string acl 
    use_backend lab_mo_api if lab_host mo_in_uri api_in_uri
    use_backend lab_portal if lab_host
  
  
  backend lab_mo_api
    reqrep (.*)\/mo\/api(\/.*) \1\ /lab\/
    redirect prefix https://&lt;aws_lambda_url&gt; code 301
  </code></pre>