Challenge 2: Why "Header set X-Proxy-Source" Doesn't Reach the
Backend — Solution Walkthrough

Why it won't achieve what the developer wants:

Header modifies the response that Apache sends back to the client --
it operates on the outbound side of the connection between Apache and
whoever made the request. The developer's actual goal is the opposite
direction entirely: adding a header to the request Apache forwards
ON to a backend application it's proxying to. Header simply has no
effect on that outbound-to-backend request at all. The header the
developer added would show up in what the client's browser receives,
not in what the backend application sees.

What they should have used instead:

RequestHeader, per this chapter's own warning box, is the directive
that modifies headers on the request as it's forwarded to a backend.
The correct line would be:

RequestHeader set X-Proxy-Source apache1

This is exactly the kind of proxy-context header injection Chapter 7
(mod_proxy) will build on directly.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader can correctly apply the
Header-vs-RequestHeader distinction to a concrete, plausible-sounding
mistake -- picking the directive whose name sounds right but whose
actual direction of effect is wrong is a very real, easy mistake to
make in practice.