Client Source Address Is Spoofed via Forwarded Headers

Forwarded-for headers supplied by the client may be appended to rather than replaced by the load balancer. Backend targets and downstream access rules that trust these headers then attribute requests to a false source address, allowing IP-based allowlists to be bypassed and access logs to be poisoned. This compromises the confidentiality of protected resources and the integrity of audit records.