Pylons/webob — pull request #175 by faassen (2014-11-20 16:38:03+00:00)
Title: A tween that adjusts request.host and request.scheme according to the Forwarded header (rfc7239)

As discussed on issue #174, implement the Forwarded header as a tween.

If you know you have a trusted proxy that sets the Forwarded header, you can use this Tween to affect request.host and request.scheme in WebOb (and thus all code that generates links based on this information).

This is a more secure alternative than doing it inside of WebOb as in pull request #160, as web applications should *not* accept the Forwarded header from untrusted sources as this opens them up to various attacks. In addition this tween also deals with the scheme bit, not just the host.

This does not support older forwarded headers like X_FORWARDED_HOST and X_FORWARDED_PROTO. We should do this in a similar tween along the same lines.