I ran into some weirdness in how Envoy handles the X-Forwarded-For headers when it's configured not to trust the incoming values. I ended up configuring Envoy to just drop all incoming X-Forwarded-* and Forwarded headers, just to be safe.
But this got me thinking: would Envoy even do anything regarding the Forwarded header, if it's designed to mainly use the X-Forwarded-* family of headers? Are there web frameworks that would support both X-Forwarded-* and Forwarded and could this behaviour be abused?
Some web frameworks and servers, including Rails, Spring and Jetty, read values from the Forwarded request header in their default configuration. Most reverse proxies, CDNs and middleware servers do not touch the Forwarded header in requests. As a result, Forwarded headers set in untrusted requests will get passed on through proxies to the web applications, which may then consider the header trusted and use the values.
