Given a system of services and a reverse proxy, such that requests may either be conclusively processed by the proxy or ultimately handled by any of the services behind the proxy.
Consideration has be given to the
X-Forwarded-Host fields. Though they appear naturally fitting for the request phase, would it be confusing to use them in the response phase?
What header field is conventionally used to declare the host that primarily provided an HTTP response?
-- The motivation for including information on proxied servers is to ease debugging and application support process.
-- I don't believe an attacker benefits specially from learning that a service makes use of a reversed proxy. Proxied servers can be identified with aliases which cannot lead to direct access to them. In the image below, the proxied server has the alias
A different implementation could use an alias as follows:
X-Backend-Server: mickymouse. That's a pointless piece of information for anyone but it's author.