The X-Forwarded-Host header is a very common header used by Reverse Proxies like Nginx and Cloudflare.
If I have both Nuxt and my API behind a reverse proxy, Nuxt gets a header like X-Forwarded-Host: my-nuxt-app.example.com so when making an API call this axios module happily copies that header over to the API Request.
When Nginx gets X-Forwarded-Host in a request it causes a lot of confusion which leads to it rewriting the Host header to be like Host: my-nuxt-app.example.com even though the request gets routed to the API Server.
This in turn confuses a lot of API Servers because they get an unexpected Host header value. Django for example has an ALLOWED_HOSTS config and uses it to secure against fake host headers.
So to summarize, I don't think there will ever be a case were a developer would want the X-Forwarded-Host header proxied by Axios, it's logically incorrect and causes a lot of confusion. This is why I think it should be part of the proxyHeadersIgnore by default and save other people the 5 hours I spent trying to debug the issue I had.
The
X-Forwarded-Hostheader is a very common header used by Reverse Proxies like Nginx and Cloudflare.If I have both Nuxt and my API behind a reverse proxy, Nuxt gets a header like
X-Forwarded-Host: my-nuxt-app.example.comso when making an API call this axios module happily copies that header over to the API Request.When Nginx gets
X-Forwarded-Hostin a request it causes a lot of confusion which leads to it rewriting theHostheader to be likeHost: my-nuxt-app.example.comeven though the request gets routed to the API Server.This in turn confuses a lot of API Servers because they get an unexpected
Hostheader value. Django for example has anALLOWED_HOSTSconfig and uses it to secure against fake host headers.So to summarize, I don't think there will ever be a case were a developer would want the
X-Forwarded-Hostheader proxied by Axios, it's logically incorrect and causes a lot of confusion. This is why I think it should be part of theproxyHeadersIgnoreby default and save other people the 5 hours I spent trying to debug the issue I had.