https://github.com/microsoft/reverse-proxy/pull/451/files#diff-0a4324a1a2cfc979ba03a1cd37836a44d3184f221cf82a121cad58dac3423d3bR419 This has been fixed in Kestrel so the mitigation can be #if removed for .NET 7 https://github.com/dotnet/aspnetcore/pull/41591