[progval]

> possibly exploit the system by sending a XFF header the developer forgot to block (probably just checking socket address so unlikely to work here)

Sadly, it was considered, and XFF is ignored from non-private source addresses: https://github.com/jart/cosmopolitan/blob/155b378a3962e4d291...

With private addresses defined as: https://github.com/jart/cosmopolitan/blob/7ab15e0b236d085c82...