code: protected function filterHeaders(HeaderCollection $headerCollection)
      {
          // do not trust any of the [[secureHeaders]] by default
          $trustedHeaders = [];
  
          // check if the client is a trusted host
          if (!empty($this->trustedHosts)) {
              $validator = $this->getIpValidator();
              $ip = $this->getRemoteIP();
              foreach ($this->trustedHosts as $cidr => $headers) {
                  if (!is_array($headers)) {
                      $cidr = $headers;
                      $headers = $this->secureHeaders;
                  }
                  $validator->setRanges($cidr);
                  if ($validator->validate($ip)) {
                      $trustedHeaders = $headers;
                      break;
                  }
              }
          }
  
          // filter all secure headers unless they are trusted
          foreach ($this->secureHeaders as $secureHeader) {
              if (!in_array($secureHeader, $trustedHeaders)) {
                  $headerCollection->remove($secureHeader);
              }
          }
      }
docs: Filters headers according to the [[trustedHosts]].
  @param HeaderCollection $headerCollection
  @since 2.0.13