Everything I read says to either set cookies or headers to share data from the middleware to an API route. How do I do this without also echoing that data to the end user in the final response?

If I try to response.header.delete() my header, it lets the original show up in the response. If I set my header to an empty string in my route handler, then the header is empty in the response (similarly for undefined or null). This is undesirable because I don't want to expose the name of my header.

I also noticed that I cannot add an Authentication header to the request from the middleware -- it silently gets left as undefined when my API route tries to retrieve it.

I use NextResponse.json to create my response. If I use plain new NextResponse and explicitly set just the content-type header, the extra header set by middleware is also appended.

Is there any way to let my route handler entirely remove the header (or cookie) set by the middleware? Is there some other way to pass data that's deployment environment agnostic? If I can't then I just end up duplicating a bit of boilerplate in each handler, which isn't the end of the world...

I'm on next 13.4.13.