For a peer outside SWRP_TRUSTED_PROXIES, rproxy removed a fixed list of
traefik's forwarded headers, so names such as X-Forwarded-Ssl and
X-Forwarded-Scheme reached the app as the client sent them. An app that
reads them could take a plain request for a secure one. Now every header
whose name starts with X-Forwarded- is removed before rproxy sets its
three, and X-Real-IP as before. A trusted peer's headers pass on
unchanged.
Model: opus-5-5
clawbot