Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
The article examines how web frameworks and servers such as Rails, Jetty, and Spring handle the standard Forwarded header alongside the older X-Forwarded-* headers. Most reverse proxies ignore Forwarded, so untrusted values pass through to applications that may prioritise them.