The idea that this is just exploitation of open proxy HTTP servers has been doing the rounds for a year, now. * https://isc.sans.edu/diary/31136 https://isc.sa

The idea that this is just exploitation of open proxy HTTP servers has been doing the rounds for a year, now. * https://isc.sans.edu/diary/31136 https://isc.sans.edu/diary/31136 However, at least one person thinks that it is a bug in the X-Forwarded-For handling code, * https://biggo.com/news/202508070812_IPv4_Games_Header_Exploitation https://biggo.com/news/202508070812_IPv4_Games_Header_Exploi... which, contrary to the headlined NANOG mailing list thread, is being parsed, as we can see: * https://github.com/jart/cosmopolitan/blob/master/net/turfwar/turfwar.c#L994 https://github.com/jart/cosmopolitan/blob/master/net/turfwar... * https://justine.lol/threads/ https://justine.lol/threads/ I think that the person who thinks that X-Forwarded-For: cannot be manipulated here needs to be put in the same room with the person who thinks that there's an endless variety of ways in which "desync" attacks can forge such headers when one uses HTTP/1.1. * https://portswigger.net/research/http1-must-die https://portswigger.net/research/http1-must-die * https://news.ycombinator.com/item?id=44915090 https://news.ycombinator.com/item?id=44915090