> possibly exploit the system by sending a XFF header the developer forgot to block (probably just checking socket address so unlikely to work here) Sadly, it

> possibly exploit the system by sending a XFF header the developer forgot to block (probably just checking socket address so unlikely to work here) Sadly, it was considered, and XFF is ignored from non-private source addresses: https://github.com/jart/cosmopolitan/blob/155b378a3962e4d291f6af577eafa1f7267b6198/tool/net/redbean.c#L883-L892 https://github.com/jart/cosmopolitan/blob/155b378a3962e4d291... With private addresses defined as: https://github.com/jart/cosmopolitan/blob/7ab15e0b236d085c822aac3e1ffa46c48c62c3fa/libc/intrin/isprivateip.c#L24-L28 https://github.com/jart/cosmopolitan/blob/7ab15e0b236d085c82...