Differences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space.
This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability.
If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.
Differences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space.
This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability.
If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.