GitLab

An app server sits on a port and anything that can reach that port looks exactly
like nginx does to it.  A pool token closes that.  nginx puts a shared secret on
every request it proxies to the pool, the backend checks it, and a scanner that
finds port 8080 gets a 403 instead of your application.

The header is set rather than added, so a client sending that header itself has
it replaced on the way through and cannot forge its way in.  It is hidden on the
way back in case the backend echoes it.

The health checker sends the token too.  Without that, the moment a backend
started enforcing it every check would come back 403, and the manager would mark
a perfectly healthy pool down and pull it out of service.

Rotation is deliberately two steps.  nginx can only send one value and you
cannot change both ends at once, so a single swap would 403 every request in the
gap.  Rotate stages a new token while nginx keeps sending the old one, you teach
...