Trusting a forwarding header without proving who wrote it is an authorisation decision

Forwarding headers are attacker-writable unless the edge replaces them; anything that grants access from a client address inherits that trust problem.