@VisibleForTesting
    void checkBlacklist(HttpRequest req, List<String> blacklist) {
        // blacklist headers from
        if (blacklist.stream().anyMatch(h -> h.equalsIgnoreCase(req.headers().get(HttpHeaderNames.HOST)))) {
            stripXFFHeaders(req);
        }
    }
Strip out any X-Forwarded-* headers from inbound http requests if connection is not trusted.
zuul-core/src/main/java/com/netflix/netty/common/proxyprotocol/StripUntrustedProxyHeadersHandler.java