Problem
The proxy strips Host (correct) but never adds X-Forwarded-For, X-Forwarded-Host, or X-Forwarded-Proto. Upstream services see the gateway's IP as the client, breaking rate limiting, geo logic, and audit logs behind the proxy.
Location
src/Services/PassageService.php
Fix
Append standard forwarded headers, with a config switch for privacy-sensitive deployments.
Sizing
Priority 16 (Impact 2, Risk 2, Effort 2). Estimated half a day.
From the tech debt audit dated 2026-07-05.
Problem
The proxy strips
Host(correct) but never addsX-Forwarded-For,X-Forwarded-Host, orX-Forwarded-Proto. Upstream services see the gateway's IP as the client, breaking rate limiting, geo logic, and audit logs behind the proxy.Location
src/Services/PassageService.phpFix
Append standard forwarded headers, with a config switch for privacy-sensitive deployments.
Sizing
Priority 16 (Impact 2, Risk 2, Effort 2). Estimated half a day.
From the tech debt audit dated 2026-07-05.