Only the Authorization header is passed. The X-Request-Id is not. Is this expected behavior? If yes, is it because such values are expected to be passed as claims?
You’re right, only “Authorization” is passed by default. Otherwise, you need to specifically add the header to an allow list. See the original message from Johan for an example: