Instrumentations SHOULD require an explicit configuration of which headers are to be captured. Including all request headers can be a security risk - explicit configuration helps avoid leaking sensitive information.
The User-Agent header is already captured in the user_agent.original attribute.
Users MAY explicitly configure instrumentations to capture them even though it is not recommended.
The attribute value MUST consist of either multiple header values as an array of strings or a single-item array containing a possibly comma-concatenated string, depending on the way the HTTP library provides access to headers.
Examples:
Content-Type: application/json SHOULD be recorded as the http.request.header.content-type
attribute with value ["application/json"].X-Forwarded-For: 1.2.3.4, 1.2.3.5 SHOULD be recorded as the http.request.header.x-forwarded-for
attribute with value ["1.2.3.4", "1.2.3.5"] or ["1.2.3.4, 1.2.3.5"] depending on the HTTP library.
HTTP request headers,
<key>being the normalized HTTP Header name (lowercase), the value being the header values.