Use only alfanumeric characters in headers that forward end-user information

[turnerrainer]

Data-Anonymizer and Resql use x-forwarded-for as header name to forward end-user IP-address to backend servers:

Data-Anonymizer/Docker_Project/Resql/target/classes/application.yml:userIPHeaderName: x-forwarded-for
Data-Anonymizer/Docker_Project/Resql/target/test-classes/application.yml:userIPHeaderName: x-forwarded-for
Data-Anonymizer/Docker_Project/Resql/Java.commons/uid-log/src/test/java/rig/commons/handlers/GenericHeaderLogHandlerTest.java:    private static final String HEADERNAME = "x-forwarded-for";
Data-Anonymizer/Docker_Project/Resql/src/main/java/rig/sqlms/config/RestConfiguration.java:    private String headerName = "x-forwarded-for";
Data-Anonymizer/Docker_Project/Resql/src/main/resources/application.yml:userIPHeaderName: x-forwarded-for
Data-Anonymizer/Docker_Project/Resql/src/test/resources/application.yml:userIPHeaderName: x-forwarded-for
Resql/src/main/java/rig/sqlms/config/RestConfiguration.java:    private String headerName = "x-forwarded-for";
Resql/src/main/resources/application.yml:userIPHeaderName: x-forwarded-for
Resql/src/test/resources/application.yml:userIPHeaderName: x-forwarded-for

Using non-alphanumeric symbols in header names that are used for forwarding end-user information might cause security issues in the future if the system starts to use a service that tries to keep backwards compatiblity with CGI scripts and end-user request headers are forwarded to such service. In this case, all non-alphanumeric characters in header names are replaced with underscores (_). A malicious end user request might already contain a header name that also converts to X_FORWARDED_FOR and the system might use the value from the users request.

Recommendation: instead of x-forwarded-for use xforwardedfor as the header name. This might also require a change in Tomcat configuration.