Trusting a forwarding header without proving who wrote it is an authorisation decision

Trusting a forwarding header without proving who wrote it is an authorisation decision Almost every web application behind a load balancer needs to know the client's address. It is used for rate limiting, for access rules, for audit records, for geo restrictions, and increasingly for deciding which internal endpoints may be reached without a... Weiterlesen: Trusting a forwarding header without proving who wrote it is an autho…