Request Smuggling Via HTTP/2 - Is Phoenix Vulnerable?

why should an edge proxy also handle access controls?

IMHO edge proxy should just do caching and load balancing.