Make sure client cert data passed in header to server isn't coming from client?

You can use the rule

HTTP::header sanitize [allowed header names]

to create a white list of headers and strip out all but those headers from the request or response. Note that the rule will not remove the essential/required HTTP headers.

set allowed_headers {goodHeader1 goodHeader2 goodHeader2} 
 HTTP::header sanitize $allowed_headers

The previous example works well if know all the allowed headers ahead of time. Here is a slightly longer version that sanitizes using a black list of headers.

set http_headers [HTTP::header names] 
 for { } { 1 } { } { 
    set index [lsearch $http_headers "badHeader"] 
    if {$index != -1} { 
        set http_headers [lreplace $http_headers $index $index ]  
    } 
    else { 
        break 
     } 
 } 
  
 HTTP::header sanitize $header_names