The Service That Believes The Header
Decide what you would do from the brief alone, including whether you would change anything at all. Everything below it is available, but the exercise stops working if you open it first.
The billing service reads X-User-Id from the request and uses it to decide which tenant's data to return. It sits behind a gateway that authenticates. A penetration test reached it directly from a compute instance in the same network and read another tenant's invoices.
Validating the header: check it is a well-formed UUID, that the user exists, and that the request arrived from the gateway's address range. Each check is individually sensible, the pen-test finding closes, and the remediation is a day's work with an obvious story. The design is unchanged — the service still believes whatever it is told about who is calling, and now believes it with more ceremony. Address ranges are a property of the network rather than of the caller, they drift under autoscaling and new subnets, and the first internal service that legitimately needs to act on a user's behalf will be given an exemption that reopens the whole thing.
Read this even if you are confident. It is here rather than behind a button because it is the answer most teams actually ship, it passes review, and the cost of it does not arrive until the change after this one.