Fix: Copilot suggested fixes

- handler.go: MeConsentApprove now routes ErrUpstreamResponseTooLarge through writeProxyError, so it returns the proper 502 UPSTREAM_RESPONSE_TOO_LARGE instead of 400 INVALID_PAYLOAD.
- service.go: proxy header filtering now strips Cookie and Authorization.

Author: rashmithachamikara

portal/backend/internal/proxy/handler.go

@@ -267,7 +267,7 @@ func (h *Handler) MeConsentApprove(w http.ResponseWriter, r *http.Request) {
 
 	payload, trustedClientID, err := h.buildApprovalUpdatePayload(r, baseResp.Body, selections, userID)
 	if err != nil {
-		if errors.Is(err, ErrUpstreamTimeout) || errors.Is(err, ErrUpstreamUnavailable) {
+		if errors.Is(err, ErrUpstreamTimeout) || errors.Is(err, ErrUpstreamUnavailable) || errors.Is(err, ErrUpstreamResponseTooLarge) {
 			h.writeProxyError(w, err)
 			return
 		}

portal/backend/internal/proxy/service.go

@@ -321,6 +321,9 @@ func (s *Service) skipHeader(name string, connectionHeaders map[string]struct{})
 	if strings.EqualFold(canonical, "Org-Id") || strings.EqualFold(canonical, "TPP-Client-Id") {
 		return true
 	}
+	if strings.EqualFold(canonical, "Cookie") || strings.EqualFold(canonical, "Authorization") {
+		return true
+	}
 	if isForwardingHeader(canonical) {
 		return true
 	}

portal/backend/tests/unit/proxy_service_test.go

@@ -315,6 +315,39 @@ func TestForwardStripsClientForwardingHeaders(t *testing.T) {
 	}
 }
 
+func TestForwardStripsClientCredentialHeaders(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Cookie"); got != "" {
+			t.Fatalf("expected Cookie to be stripped, got %q", got)
+		}
+		if got := r.Header.Get("Authorization"); got != "" {
+			t.Fatalf("expected Authorization to be stripped, got %q", got)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+
+	svc, err := proxy.NewService(config.ProxyConfig{
+		OpenFGCAPIURL:      upstream.URL,
+		OpenFGCAPITimeout:  2 * time.Second,
+		MaxRequestBytes:    1024,
+		MaxResponseBytes:   1024,
+		AllowedPassthrough: []string{"GET"},
+	})
+	if err != nil {
+		t.Fatalf("failed to construct service: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "http://bff.local/api/consents", nil)
+	req.Header.Set("Cookie", "sid=secret")
+	req.Header.Set("Authorization", "Bearer secret")
+
+	rr := httptest.NewRecorder()
+	if err := svc.Forward(rr, req, http.MethodGet, "/api/v1/consents", nil, nil); err != nil {
+		t.Fatalf("unexpected forward error: %v", err)
+	}
+}
+
 func TestForwardGeneratesCorrelationIDWhenMissing(t *testing.T) {
 	var gotCorrelationID string
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {