xB3Traceid added to the response headers

[pachecopaulo]

Describe the bug
Spring boot 2.4.4
Spring Cloud Sleuth 3.02
Spring Cloud 2020.0.2

Reading this GitHub isssue it was clear the xB3Traceid header wouldn't be included in the response headers due to security concerns but that's not the case. Regardless whether I add the X-b3-traceid header or not in the request it is always injected in the response.

I didn't add any snippet to the description because there is no explicit configuration for Sleuth, it's configured via Spring Boot auto-configuration. I only had to configure the CorsConfigurationSource to allow the "X-b3-spanid" and "X-b3-traceid" headers.

Is there a way to configure Sleuth to not add this header in the response?

[marcingrzejszczak]

We're not setting any headers in the response. Why do you think Sleuth is doing that?