defense in depth

What is X-Forwarded-For (XFF) spoofing: trusted-proxy misconfiguration and defense

XFF is a client-forgeable header. An indiscriminate scanner puts injection probes in a spoofed XFF, and a 'trust all proxies (wildcard)' setting lets it through. Short-term fix: sanitize the IP header at the boundary. Root-cause fix: trust only the right proxies (or none). Zero impact still left a setting to fix.