@Test
void writeHttpHeadersWhenNewHttpHeadersFails() {
	HttpHeaders originalExchangeHeaders = HttpHeaders.readOnlyHttpHeaders(new HttpHeaders());
	HttpHeaders firewallHeaders = new HttpHeaders(originalExchangeHeaders);
	HttpHeaders writeable = HttpHeaders.writableHttpHeaders(firewallHeaders);
	writeable.set("test", "this"); // throws UnsupportedOperationException
}

@Test
void writableHttpHeadersWhenStrictFirewallHttpHeadersFails() {
	// originalExchangeHeaders is what is passed in to WebFilter by the framework
	HttpHeaders originalExchangeHeaders = HttpHeaders.readOnlyHttpHeaders(new HttpHeaders());
	// Spring Security replaces the headers with a firewalled set of headers that
	// lazily validates headers as they are accessed
	HttpHeaders firewallHeaders = new StrictFirewallHttpHeaders(originalExchangeHeaders);
	// Spring Cloud attempts to modify the now firewalled HttpHeaders, but writeableHttpHeaders does not work
	HttpHeaders writeable = HttpHeaders.writableHttpHeaders(firewallHeaders);
	writeable.set("test", "this"); // throws UnsupportedOperationException
}

// minimal demonstration of Spring Security's HttpHeaders
private static class StrictFirewallHttpHeaders extends HttpHeaders {
	private StrictFirewallHttpHeaders(HttpHeaders original) {
		super(original);
	}

	@Override
	public String getFirst(String headerName) {
		String result = super.getFirst(headerName);
		// validate headerName / result
		return result;
	}

	// ... other validation
}