Web frameworks like Rails, Spring, and Jetty trust the Forwarded header by default, while most reverse proxies do not validate or strip it — creating a spoofing vector for client IPs and hostnames. The author discovered this while configuring Envoy as a reverse proxy and dropping all X-Forwarded-* and Forwarded headers as a mitigation.
Background
RFC 7239 defines the Forwarded header as a standardized replacement for the non-standard X-Forwarded-* headers. Despite its specification, there is no universal enforcement of who should set or trust these headers in practice.
- Source
- Lobsters
- Published
- Nov 7, 2026 at 02:18 PM
- Score
- 7.0 / 10