Description

The webpack dev server captures the kubeconfig token at startup and sets it as a static proxy header via headers: getProxyHeaders(). This overwrites any dynamically forwarded auth headers from a host backend proxy, breaking dev impersonation (e.g. DEV_IMPERSONATE_USER/DEV_IMPERSONATE_PASSWORD).

This PR replaces the static headers approach with an onProxyReq callback that dynamically forwards the Authorization header from each incoming request when present, falling back to the startup-captured token for standalone dev mode.

The same fix was applied to the model-registry UI in kubeflow/hub#2544.

Changes

• Split getProxyHeaders() into:
  • getKubeconfigToken() — captures kubeconfig token at startup (fallback)
  • getProxyHeaders() — returns only static headers (kubeflow-userid for internal auth)
  • onProxyReq — dynamically forwards Authorization and x-forwarded-access-token headers per request
• Proxy config now uses both headers: getProxyHeaders() (static) and onProxyReq (dynamic)

How Has This Been Tested?

Tested manually in the model-registry module (same fix pattern) against an ODH cluster:

1. Started the host backend with DEV_IMPERSONATE_USER and DEV_IMPERSONATE_PASSWORD set
2. Verified the bug: with static headers, the impersonated user's token was overwritten by the startup token
3. Verified the fix: with onProxyReq, the incoming auth header from the host proxy is forwarded correctly