Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header https://lobste.rs/s/m5kism #security https://www.lkoskela.fi/blog/2026-11-05-forwarded-without-question/