It was possible to (1) add the "x-forwarded-proto" header with an attacker controlled host and malicious file, then (2) copy the URL that you sent the HTTP request to, and (3) send the full URL to a victim where it had been cached whereby the XSS payload would trigger after opening. When building the URL that the server sends the HTTP request to after a user requests a resource, there is a piece of code which accepts input via the "x-forwarded-proto" header and allows an attacker to completely overwrite the URL which the HTTP request is sent to.