Security Threats - web development

Threats

Desired Outcome For App	Threat	Description	Supporting documentation
Log IP of users	XSS (maybe more?)	Utilizing random header from X_FORWARDED_FOR header could lead to XSS	https://esd.io/blog/flask-apps-heroku-real-ip-spoofing.html