bulk88 7271e29f21 remove Heroku specific Req headers from being sent to Origin ...

-saves bytes, and avoids triggering IDS/WAF alarms since browser finger
 printing will prove these headers are unnatural and on SSL must be a MITM
 attack

-leave x-forwarded-* intact since they can be used to block CORS proxy
 abuse if the not-CORS origin webmaster really has to block the proxy
 and they are not unique to Heroku platform

2020-09-28 06:19:06 -04:00

1.8 KiB

Raw Blame History

View Raw