ate limit services can check for NULs in headers. Backend servers might have sufficient logging to detect NULs or unintended
access; it’s likely that many will simply reject NULs in this scenario via 400 Bad Request, as per RFC 7230.</p><h2 id=detection-of-path-traversal-exploit>Detection of path traversal exploit</h2><p>Envoy’s access logs (whether file-based or gRPC) will contain the unnormalized path, so it is possible to examine these logs to detect suspicious patterns and
requests that are incongru