[roxblnfk]

🔍 What was changed

• A request field named outside [A-Za-z0-9-] no longer reaches the server params, and so neither Laravel's headers: Symfony builds its header bag from them.
• . is no longer folded into _: X_Forwarded_For and X.Forwarded.For used to land on HTTP_X_FORWARDED_FOR and pose as the real header, trusted proxy handling included.

Why?

In worker mode the host drops such fields before filling $_SERVER (unsafe_field_names = "drop", the default); in dispatcher mode it passes them through, so the factory has to drop them itself to match. Same as rapira-rs/sdk-php's dispatcher factory does.

Checklist

• How was this tested:
  • Unit tests updated
  • Unit and Feature suites and php-cs-fixer run locally
  • Acceptance suite

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c6607423-4308-431e-8696-84ed28af6127

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}