What the proxy forwarded

This app is an upstream behind the Space Proxy. It owns no config or session — its entire worldview is the request the proxy hands it. Everything below is that request.

Identity

X-Forwarded-User	absent — reached without an SSO proxy in front

Request as this app sees it

host	`hk-tmp-test-delete-me-2-test-d4ba1a0fb014.aster-virginia.herokuapp.com` ← proxy rewrote Host to this upstream
method	`GET`
path	`/`
proto	`HTTP/1.1`
tls	`false`

Forwarded headers (set by the proxy)

none

Proxy cookies (should be stripped)

space_session	absent ✓
space_flow	absent ✓

Leaked inbound headers (tamper check)

X-Forwarded-For	`216.73.216.17` ← client-supplied X-Forwarded-*; proxy should have stripped it
X-Forwarded-Port	`443` ← client-supplied X-Forwarded-*; proxy should have stripped it
X-Forwarded-Proto	`https` ← client-supplied X-Forwarded-*; proxy should have stripped it