Everybody and their grandmother seems to be building/using their own x-header field. It's just a matter of time before an x-header or combination of x-headers b

Everybody and their grandmother seems to be building/using their own x-header field. It's just a matter of time before an x-header or combination of x-headers becomes a real threat vector. I think there should be some level of additional 'standard' headers (yea, cue XKCD "and now we have 16 standards". Our inspection firewall logs and dumps unknown x-'s like yours does. We meet once a month to go through them and either deny or clear them. Like your admins, if someone says "Astroscript" isn't working someone will dig into it. X-headers are not the way to do data passing. There are other ways to make that happen other than creating new headers.