I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance).
Client --> https://myapp.com --> nginx --> https://10.1.5.9
I managed to do so, but it required stripping the "Origin" and "Referer" headers from the client request because the webserver won't accept authentications if those headers aren't https://10.1.5.9
(and the client browser automatically sets them to https://myapp.com
).
I don't fully understand CORS and the "Origin" header. Is it a bad idea to strip this header from client requests? Could it expose my app to security vulnerabilities?