Paranoia: drop the headers we don't use

core/nginx/conf/proxy.conf

@@ -1,8 +1,9 @@
 # Default proxy setup
 proxy_set_header Host $http_host;
 proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header True-Client-IP $remote_addr;
-proxy_set_header Forwarded "";
+proxy_hide_header True-Client-IP;
+proxy_hide_header CF-Connecting-IP;
+
 proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
 {% if REAL_IP_HEADER and REAL_IP_FROM %}
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -10,3 +11,8 @@ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-For $remote_addr;
 {% endif %}
 proxy_http_version 1.1;
+proxy_hide_header Forwarded;
+proxy_hide_header X-Forwarded-Host;
+proxy_hide_header X-Forwarded-Server;
+proxy_hide_header X-Host;
+proxy_hide_header X-HTTP-Host-Override;