中风险
示例直接信任并传播客户端提供的请求 ID
原文依据：3 处发现了什么
中间件接受任意 `x-request-id`，随后把它写入日志上下文、响应头并按指南传播至下游；没有格式、长度、唯一性或可信来源检查。
为什么需要注意
能够发送请求的人可复用或伪造请求 ID，把无关事件混在同一查询结果中，误导事件调查；超长或异常值还可能在日志、队列元数据或下游请求头中放大处理问题。
该指南把相关 ID 设为强制项，示例会直接接受客户端提供的 `x-request-id`，再写入日志上下文和响应头，并要求跨下游边界传播。若应用照搬且未在别处验证，攻击者可提交超长、格式异常或重复的 ID，污染日志、误导请求关联，并把不可信值传给下游。这里是示例而非完整实现，因此不能断言验证一定缺失；用户可要求作者明确规定长度、字符集、可信边界及重新生成策略。
**Correlation IDs are mandatory.** Generate (or accept) a request ID at the system boundary and attach it to every log line, span, and outbound call. Without it, you cannot reconstruct a single request from interleaved logs:```typescript// Express: child logger per request, ID propagated downstreamapp.use((req, res, next) => { req.id = req.headers['x-request-id'] ?? crypto.randomUUID(); req.log = logger.child({ requestId: req.id }); res.setHeader('x-request-id', req.id); next();查看另外 2 个位置
Both fields have to cross the same boundaries as the correlation ID — queue metadata, HTTP headers — or a worker re-derives the entry point and guesses. A field that merely correlates with an entry point is a hint, not an attribution: anything that can invoke the job can reproduce it.// Express: child logger per request, ID propagated downstreamapp.use((req, res, next) => { req.id = req.headers['x-request-id'] ?? crypto.randomUUID(); req.log = logger.child({ requestId: req.id }); res.setHeader('x-request-id', req.id); next();});