RequestHandler::RequestHandler(
    std::shared_ptr<CheckWorkflow> check_workflow,
    std::shared_ptr<context::ServiceContext> service_context,
    std::unique_ptr<Request> request_data)
    : context_(new context::RequestContext(service_context,
                                           std::move(request_data))),
      check_workflow_(check_workflow) {
  // Remove x-endponts-api-userinfo from downstream client.
  // It should be set by the last Endpoint proxy to prevent users spoofing.
  std::string buffer;
  if (context_->request()->FindHeader(
          google::api_manager::auth::kEndpointApiUserInfo, &buffer)) {
    context_->request()->AddHeaderToBackend(
        google::api_manager::auth::kEndpointApiUserInfo, "");
  }
}
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.