void RequestContext::StartBackendSpanAndSetTraceContext() {
  backend_span_.reset(CreateSpan(cloud_trace_.get(), "Backend"));

  // TODO: A better logic would be to send for GRPC backends the grpc-trace-bin
  // header, and for http/https backends the X-Cloud-Trace-Context header.

  std::string trace_context_header = cloud_trace()->ToTraceContextHeader(
      backend_span_->trace_span()->span_id());

  // Set trace context header to backend.
  Status status = request()->AddHeaderToBackend(
      cloud_trace()->header_type() == HeaderType::CLOUD_TRACE_CONTEXT
          ? kCloudTraceContextHeader
          : kGRpcTraceContextHeader,
      trace_context_header);
  if (!status.ok()) {
    service_context()->env()->LogError(
        "Failed to set trace context header to backend.");
  }
}
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.