How to debug cloudfront behaviours not sending requests to correct origin?

Figured it out:

I had the behaviours configured to pass through all headers (including the Host header). As Heroku uses global routing, app-a.herokuapp.com and app-b.herokuapp.com both resolve to the same thing, and Heroku uses the host header to route to the correct heroku app. So for e.g. curl app-a.herokuapp.com -H "Host: app-b.herokuapp.com" will make a request to app b, not app a.

For historical reasons, the overall domain name (let's call it example.com) had been "added" to heroku app b, so curl app-a.herokuapp.com -H "Host: example.com" would resolve to app b. Very confusing!

To fix this I created a custom cache policy that sent through all headers except the Host header, and changed the origins to add a hardcoded X-Forwarded-Host header set to the domain name, in this case example.com. Now the routing works, and the X-Forwarded-Host can be used by the two apps to know what host they've been accessed from. (One of them is Rails, which picks up the X-Forwarded-Host header automatically).