Repair Proxy Trust Header Bugs

The problem

Reverse proxy header parsing is often inconsistent across different service layers, leading to incorrect client IP detection or broken secure request redirects. Developers struggle with fragmented trust boundaries where one component trusts X-Forwarded-For while another ignores it, causing auth failures or protocol mismatches.

What it does

• Identifies and patches inconsistent X-Forwarded-* and Forwarded header parsing logic.
• Standardizes client IP extraction and canonical host reconstruction across service paths.
• Audits and repairs trusted proxy hop lists and CIDR validation boundaries.
• Generates deterministic local fixtures and regression tests for multi-hop proxy scenarios.
• Implements centralized normalization to prevent state ownership conflicts during TLS termination.

Why this beats prompting it yourself

Manual prompts often result in insecure workarounds that weaken validation just to fix a bug. This skill enforces strict trust boundaries and protocol policies while ensuring validation happens before irreversible state changes, preventing common security regressions in proxy handling.

Use cases

• Fixing incorrect HTTPS redirection loops behind a Load Balancer.
• Resolving client IP spoofing vulnerabilities by hardening trust policies.
• Aligning host header reconstruction across legacy and modern service paths.
• Standardizing header cleanup to prevent sensitive data leakage between proxy hops.

Known limitations

Does not access live production environments or secrets. Relies on repository files and local fixtures to simulate proxy behavior.