Function try_http_headers_to_grpc_metadata 

pub fn try_http_headers_to_grpc_metadata(
    headers: &HeaderMap,
    forwarded_headers: &[String],
) -> Result<MetadataMap, InvalidForwardedHeader>

Extract HTTP headers into a gRPC MetadataMap, or refuse the request.

Forwards every value of each header listed in forwarded_headers, in order and byte for byte, as Envoy’s gRPC-JSON transcoder and grpc-gateway do: the upstream sees how many times the client sent a header, which some checks depend on (RFC 9449 §4.3 rejects a request with more than one DPoP). Then always propagates W3C trace-context (forwarding an incoming traceparent or synthesizing one so the upstream joins a single trace across the REST↔gRPC boundary). That step owns traceparent and tracestate even when they are listed: the upstream gets exactly one valid traceparent, and every tracestate line only with the trace it belongs to.

x-forwarded-for, x-real-ip and forwarded are never forwarded, listed or not: they carry what the client asserts about its address, which only the proxy’s client-address resolution may turn into an address (ClientAddress).

Errors

A forwarded value gRPC metadata cannot carry: empty or outside visible ASCII and space for a text key, not base64 for a -bin key (gRPC PROTOCOL-HTTP2, “Custom-Metadata”). gRPC lets a receiver drop such a value, which would change how many values the upstream sees, so the request is refused rather than forwarded altered.