Hacker News Reader

That's not the point here. It's an adversary getting two CDNs to loop eachother and launching an attack that way.

If CDN A proxies requests to CDN B and CDN B proxies requests to CDN A then those two will DoS eachother fairly quickly.

There is no attacker inbetween to strip the Via, that would be counterproductive to the attack.

Email has this too; the Received: header. If you manage to get a loop between two MTAs going they will detect it by seeing themselves in the Received: header list.

If other CDNs are removing your Via header, then other CDNs are the adversary, but now we're in Crazy Town because in that case they are DOSing themselves as much as they are DOSing you. The threat discussed here is from malicious CDN customers.

The proper check is in routing tables and/or firewalls.

> If you are under attack

If. Much, if not most, server software is written under the implicit assumption that it will not be under attack.

But these particular Via headers are applied by the CDNs, not by an end user.