@Override
    public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
        if (msg instanceof HttpRequest req) {
            switch (allowWhen) {
                case NEVER:
                    stripXFFHeaders(req);
                    break;
                case MUTUAL_SSL_AUTH:
                    if (!connectionIsUsingMutualSSLWithAuthEnforced(ctx.channel())) {
                        stripXFFHeaders(req);
                    } else {
                        checkBlacklist(req, XFF_BLACKLIST.get());
                    }
                    break;
                case ALWAYS:
                    checkBlacklist(req, XFF_BLACKLIST.get());
                    break;
                default:
                    // default to not allow.
                    stripXFFHeaders(req);
            }
        }

        super.channelRead(ctx, msg);
    }
Strip out any X-Forwarded-* headers from inbound http requests if connection is not trusted.
zuul-core/src/main/java/com/netflix/netty/common/proxyprotocol/StripUntrustedProxyHeadersHandler.java