void ConnectionManagerUtility::mutateXfccRequestHeader(RequestHeaderMap& request_headers,
                                                       Network::Connection& connection,
                                                       ConnectionManagerConfig& config) {
  // When AlwaysForwardOnly is set, always forward the XFCC header without modification.
  if (config.forwardClientCert() == ForwardClientCertType::AlwaysForwardOnly) {
    return;
  }
  // When Sanitize is set, or the connection is not mutual TLS, remove the XFCC header.
  if (config.forwardClientCert() == ForwardClientCertType::Sanitize ||
      !(connection.ssl() && connection.ssl()->peerCertificatePresented())) {
    request_headers.removeForwardedClientCert();
    return;
  }

  // When ForwardOnly is set, always forward the XFCC header without modification.
  if (config.forwardClientCert() == ForwardClientCertType::ForwardOnly) {
    return;
  }

  // TODO(myidpt): Handle the special characters in By and URI fields.
  // TODO: Optimize client_cert_details based on perf analysis (direct string appending may be more
  // preferable).
  std::vector<std::string> client_cert_details;
  // When AppendForward or SanitizeSet is set, the client certificate information should be set into
  // the XFCC header.
  if (config.forwardClientCert() == ForwardClientCertType::AppendForward ||
      config.forwardClientCert() == ForwardClientCertType::SanitizeSet) {
    const auto uri_sans_local_cert = connection.ssl()->uriSanLocalCertificate();
    if (!uri_sans_local_cert.empty()) {
      client_cert_details.push_back(absl::StrCat("By=", uri_sans_local_cert[0]));
    }
    const std::string cert_digest = connection.ssl()->sha256PeerCertificateDigest();
    if (!cert_digest.empty()) {
      client_cert_details.push_back(absl::StrCat("Hash=", cert_digest));
    }
    for (const auto& detail : config.setCurrentClientCertDetails()) {
      switch (detail) {
      case ClientCertDetailsType::Cert: {
        const std::string peer_cert = connection.ssl()->urlEncodedPemEncodedPeerCertificate();
        if (!peer_cert.empty()) {
          client_cert_details.push_back(absl::StrCat("Cert=\"", peer_cert, "\""));
        }
        break;
      }
      case ClientCertDetailsType::Chain: {
        const std::string peer_chain = connection.ssl()->urlEncodedPemEncodedPeerCertificateChain();
        if (!peer_chain.empty()) {
          client_cert_details.push_back(absl::StrCat("Chain=\"", peer_chain, "\""));
        }
        break;
      }
      case ClientCertDetailsType::Subject:
        // The "Subject" key still exists even if the subject is empty.
        client_cert_details.push_back(
            absl::StrCat("Subject=\"", connection.ssl()->subjectPeerCertificate(), "\""));
        break;
      case ClientCertDetailsType::URI: {
        // The "URI" key still exists even if the URI is empty.
        const auto sans = connection.ssl()->uriSanPeerCertificate();
        const auto& uri_san = sans.empty() ? "" : sans[0];
        client_cert_details.push_back(absl::StrCat("URI=", uri_san));
        break;
      }
      case ClientCertDetailsType::DNS: {
        auto dns_sans = connection.ssl()->dnsSansPeerCertificate();
        if (!dns_sans.empty()) {
          for (const std::string& dns : dns_sans) {
            client_cert_details.push_back(absl::StrCat("DNS=", dns));
          }
        }
        break;
      }
      }
    }
  }

  const std::string client_cert_details_str = absl::StrJoin(client_cert_details, ";");
  if (config.forwardClientCert() == ForwardClientCertType::AppendForward) {
    request_headers.appendForwardedClientCert(client_cert_details_str, ",");
  } else if (config.forwardClientCert() == ForwardClientCertType::SanitizeSet) {
    request_headers.setForwardedClientCert(client_cert_details_str);
  } else {
    NOT_REACHED_GCOVR_EXCL_LINE;
  }
}