When you send a POST request to your server, you think you're sending the information to YOUR server, right? That was the default behaviour - as it should be. After updating the Postman client, I noticed Postman also sends the request to their internal servers, which then sends your server the actual request (proxying). I thought I was paranoid until another commenter confirmed the same (https://news.ycombinator.com/item?id=50358055). It's fucking annoying that something called POSTman does anything but that. Please don't use Postman for anything sensitive. It's borderline spyware, especially when you didn't consent to this behavior.