[Cloudfront] Are there security implications to the ALL_VIEWER origin request policy?

I don't think you really answered the question here; Like why is this is best practise? Does it have any security implications for example? Perhaps based on those best practises?

For example my assumption would be that it in general makes sense to include all headers because;

• As you pointed out, cloudfront doesn't use all of them for caching, so no adverse effects there
• The origin will mostly likely only parse the headers it needs to function
• Lastly, in terms of logging request from your server to debug failed request or even detect malicious requests, it would be more helpfull to have more headers as you have more information from the request made.

I am probably wrong as you pointed out it's better to only select the ones needed, so I would live to know why!