Making decisions based on HTTP headers is always an opportunity to be surprised. A few years back we had implemented rudimentary access control on a server base

Making decisions based on HTTP headers is always an opportunity to be surprised. A few years back we had implemented rudimentary access control on a server based on X-Forwarded-For. In front of that server, we had two chained instances of haproxy, one version 1.x, the other 2.x. Little did we know that haproxy 1 and 2 handled headers completely different wrt case-sensitivity. So we ended up not only not correctly removing untrusted headers, we also got two different headers with every request (mixed-case and lower-case) that our server handled differently (which was a bug).