3631235 - X-Forwarded-Host header validation in BTP Approuter

• It is necessary to validate the X-Forwarded-Host header in a BTP Approuter application to mitigate possible vulnerabilities, like open redirect.
• The ENABLE_X_FORWARDED_HOST_VALIDATION Environment Variable was defined in the Approuter, but a modified X-Forwarded-Host header is returning 301 instead of, for example, a 404 or 500.

SAP BTP, Cloud Foundry runtime and environment

x-forwarded-host, vulnerability, open redirect, client side url redirect, redirection, environment variable, approuter, x-forwarded-server-, x-host, ENABLE_X_FORWARDED_HOST_VALIDATION , KBA , BC-CP-APR , SAP BTP Application Router , How To