void RequestContext::AddInstanceIdentityToken() {
  if (!method()) {
    return;
  }

  const auto &audience = method()->backend_jwt_audience();
  if (!audience.empty()) {
    auto &token = service_context()
                      ->global_context()
                      ->GetInstanceIdentityToken(audience)
                      ->GetAuthToken();
    if (!token.empty()) {
      std::string origin_auth_header;
      if (request()->FindHeader(kAuthorizationHeader, &origin_auth_header)) {
        Status status = request()->AddHeaderToBackend(
            kXForwardedAuthorizationHeader, origin_auth_header);
        if (!status.ok()) {
          service_context()->env()->LogError(
              "Failed to set X-Forwarded-Authorization header to backend.");
        }
      }
      Status status = request()->AddHeaderToBackend(kAuthorizationHeader,
                                                    kBearerPrefix + token);
      if (!status.ok()) {
        service_context()->env()->LogError(
            "Failed to set authorization header to backend.");
      }
    }
  }
}
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.