1. What version of Go are you using (go version)?
   1.6
2. What operating system and processor architecture are you using (go env)?
   GOARCH="amd64"
   GOBIN=""
   GOEXE=""
   GOHOSTARCH="amd64"
   GOHOSTOS="linux"
   GOOS="linux"
   GOPATH="/go"
   GORACE=""
   GOROOT="/usr/local/go"
   GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
   CC="gcc"
   GOGCCFLAGS="-fPIC -m64 -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build436466338=/tmp/go-build -gno-record-gcc-switches"
   CXX="g++"
   CGO_ENABLED="0"
3. What did you do?
   I created a basic reverse proxy:

package main

import (
    "log"
    "net/http"
    "net/http/httputil"
)

func main() {
    log.Fatal(http.ListenAndServe(":80", &httputil.ReverseProxy{
        Director: func(req *http.Request) {
            req.URL.Scheme = "http"
            req.URL.Host = "admin-monolith"
        },
    }))
}

Then I sent this HTTP request to the proxy (based on an example in the HTTP/2 spec):

GET / HTTP/1.1
Host: server.example.com
Connection: Upgrade, HTTP2-Settings
Upgrade: h2c
HTTP2-Settings: abcdef...

1. What did you expect to see?
   According to the Connection header, HTTP2-Settings is a hop-by-hop header, so I expected that the proxy would strip this header before forwarding the request.
2. What did you see instead?
   The HTTP2-Settings header (but not the Upgrade) header was not stripped but was forwarded to the backend server.

Stripping hop-by-hop headers was implemented in #2735, but only headers explicitly mentioned in RFC 2616 are removed.

The relevant quote from RFC 7230, section 6.1 is this:

A proxy or gateway MUST parse a received Connection header field before
a message is forwarded and, for each connection-option in this field,
remove any header field(s) from the message with the same name as the
connection-option, and then remove the Connection header field itself
(or replace it with the intermediary's own connection options for the
forwarded message).

The same requirement was included in RFC 2616, section 14.10.