diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go
index 12d232b27c..48f3a81e9b 100644
--- a/internal/ingress/annotations/authreq/main.go
+++ b/internal/ingress/annotations/authreq/main.go
@@ -218,8 +218,8 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) {
 			return nil, ing_errors.NewLocationDenied(fmt.Sprintf("unable to find configMap %q", proxySetHeaderMap))
 		}
 
-		for header, value := range proxySetHeadersMapContents.Data {
-			if !ValidHeader(header) || !ValidHeader(value) {
+		for header := range proxySetHeadersMapContents.Data {
+			if !ValidHeader(header) {
 				return nil, ing_errors.NewLocationDenied("invalid proxy-set-headers in configmap")
 			}
 		}
diff --git a/internal/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go
index c57344e19a..914b6882aa 100644
--- a/internal/ingress/annotations/authreq/main_test.go
+++ b/internal/ingress/annotations/authreq/main_test.go
@@ -276,8 +276,8 @@ func TestProxySetHeaders(t *testing.T) {
 	}{
 		{"single header", "http://goog.url", map[string]string{"header": "h1"}, false},
 		{"no header map", "http://goog.url", nil, true},
-		{"header with spaces", "http://goog.url", map[string]string{"header": "bad value"}, true},
-		{"header with other bad symbols", "http://goog.url", map[string]string{"header": "bad+value"}, true},
+		{"header with spaces", "http://goog.url", map[string]string{"header": "bad value"}, false},
+		{"header with other bad symbols", "http://goog.url", map[string]string{"header": "bad+value"}, false},
 	}
 
 	for _, test := range tests {