4 ms·
TL;DR don't trust the values of headers you don't control. If you're not sure whether you control them or not, read the rest of this article.
by apitman 5y ago
TL;DR don't trust the values of headers you don't control. If you're not sure whether you control them or not, read the rest of this article.
- rhizome 5y agoRight? "Don't depend on anything fakeable."
- freedomben 5y agoI think a part of the problem though is that "control" is not always well defined. I've seen headers used that were "controlled" because a proxy sat in front and did filtering. But then the app got moved behind a different proxy, and what they controlled was no longer such. But, if you don't trust any headers at all, it's tough to do much with HTTP.