HUMAN VERIFICATION REQUIRED ASVS 4.1.3 Trusted intermediary headers

Any HTTP header field used by the application and set by an intermediary layer, such as a load balancer, a web proxy, or a backend-for-frontend service, cannot be overridden by the end-user. Example headers might include X-Real-IP, X-Forwarded-\*, or X-User-ID.