OkapiFeignClientExceptionHandler passes all headers from Okapi to the client, only headers that start with x-okapi are excluded:
https://github.com/folio-org/edge-fqm/blob/ada57ccb6f8a244cb86cacecc89630996b910d27/src/main/java/org/folio/fqm/edge/client/config/OkapiFeignClientExceptionHandler.java

This may pass sensitive headers, for example:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
Content-Encoding: br
X-Okapi-Token: akjshdjkshad.asjdhjshdj.asjkldhsd

Passing Content-Encoding is wrong. There are two different HTTP connections that may use different encodings based on the capabilities of the two endpoints: client < - > edge-fwqm, and edge-fqm < - > okapi. It's possible that okapi uses br encoding that the client doesn't support so that edge-fqm receives in a different encoding than it sends in.

X-Okapi-Token is passed because only lower case x-okapi-token is filtered.

There is no complete list of sensitive headers. Therefore we cannot use a deny list.

FOLIO tries to mitigate header injection by only using allow lists instead: https://folio-org.atlassian.net/issues/?jql=summary%20~%20header%20and%20labels%20%3D%20security

Content-Type header should be passed. Can this be used as the single element allow list or are there any others that are needed?