A payment integration kept failing its communications check with an authentication error: the credential the site held did not match the one the provider's server expected. The obvious readings were a stale key or a mismatched site URL.
Both were wrong, and either fix would have been a manual credential edit that did not hold.
The gateway did not authenticate the way it appeared to. It refreshed its credential through an inbound callback from the vendor's master server — no API route, no hook, nothing the site initiated. That callback carried the credential.
The site sat behind a CDN in front of its host. That proxy chain restored the true originating address correctly, and passed the CDN's own client-address header duplicated — the same value repeated three times in one header.
The gateway had an anti-spoofing guard comparing that header against the connecting address. Duplicated, they no longer matched. The guard concluded the request was forged and silently discarded the payload. The credential never arrived, and the communications check kept failing with an error describing a symptom several layers away from its cause.
Nothing in the failure message pointed at the CDN.
Proxy chains change the request, and downstream software has opinions
Anything doing address-based validation — fraud rules, rate limits, geo restrictions, anti-spoofing — is reading headers that a CDN, load balancer, or WAF may have rewritten. Symptoms surface as authentication errors, phantom fraud blocks, or intermittent failures, and they are consistently misdiagnosed as credential problems.
The fix has to keep the guard working
The correction collapses the header only when every repeated value is identical. A genuinely differing — that is, actually forged — header still trips the anti-spoofing check. The security property is preserved rather than disabled, which is the difference between a fix and a workaround.
The tell was in a debug log nobody had turned on
Enabling the gateway's own diagnostic output and reading its trace named the spoofing rejection directly. Two minutes of instrumentation replaced hours of hypothesis.
- ✓A small platform-level plugin normalising the duplicated header
- ✓The credential synchronised on the next refresh; the communications check returned clean
- ✓No credential was hand-edited, so there was nothing to re-break at the next refresh
- ✓The same class of failure is now diagnosable in minutes wherever the same CDN-and-gateway combination appears
Client, vendor, product and industry details are removed, along with any figures belonging to the client. The technical detail is unchanged. This shows how we work — it is not a claim about a business result, which would require the client’s consent and a baseline measured before the work began.