What the proxy forwarded

This app is an upstream behind the Space Proxy. It owns no config or session — its entire worldview is the request the proxy hands it. Everything below is that request.

Identity

X-Forwarded-Userabsent — reached without an SSO proxy in front

Request as this app sees it

hosthk-customer-0-fir-poc-test-12aed3d5417c.cherry-virginia.herokuapp.com ← proxy rewrote Host to this upstream
methodGET
path/
protoHTTP/1.1
tlsfalse

Forwarded headers (set by the proxy)

none

Proxy cookies (should be stripped)

space_sessionabsent ✓
space_flowabsent ✓

Leaked inbound headers (tamper check)

X-Forwarded-For216.73.216.128 ← client-supplied X-Forwarded-*; proxy should have stripped it
X-Forwarded-Port443 ← client-supplied X-Forwarded-*; proxy should have stripped it
X-Forwarded-Protohttps ← client-supplied X-Forwarded-*; proxy should have stripped it