From d2fd6edd3ab6261a7f7f5bb1923ebef0b9d00934 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Fri, 7 Aug 2026 14:40:10 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20restore=20proxyToBackend=20=E2=80=94=20h?=
 =?UTF-8?q?eader=20approach=20was=20returning=20empty=20200?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 middleware.go | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/middleware.go b/middleware.go
index cadaf82..bf76d95 100644
--- a/middleware.go
+++ b/middleware.go
@@ -45,16 +45,14 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
 
 	if !cfg.Enabled {
 		atomic.AddUint64(&requestsBypassed, 1)
-		w.Header().Set("X-Zoraxy-Status", "unhandled")
-		w.WriteHeader(http.StatusOK)
+		proxyToBackend(w, r)
 		return
 	}
 
 	if breaker.State() == StateOpen {
 		atomic.AddUint64(&requestsBypassed, 1)
 		log.Printf("Firewall: breaker OPEN — fail-open %s %s", r.Method, r.URL.Path)
-		w.Header().Set("X-Zoraxy-Status", "unhandled")
-		w.WriteHeader(http.StatusOK)
+		proxyToBackend(w, r)
 		return
 	}
 
@@ -63,8 +61,7 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
 		atomic.AddUint64(&requestsBypassed, 1)
 		log.Printf("Firewall: inspection error — fail-open: %v", err)
 		breaker.RecordFailure()
-		w.Header().Set("X-Zoraxy-Status", "unhandled")
-		w.WriteHeader(http.StatusOK)
+		proxyToBackend(w, r)
 		return
 	}
 
@@ -79,14 +76,10 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
 	}
 
 	atomic.AddUint64(&requestsAllowed, 1)
-	w.Header().Set("X-Zoraxy-Status", "unhandled")
-	w.WriteHeader(http.StatusOK)
+	proxyToBackend(w, r)
 }
 
-// proxyToBackend forwards the request to Zoraxy's original upstream.
-// The original target is passed by Zoraxy via the X-Zoraxy-Uri header.
 func proxyToBackend(w http.ResponseWriter, r *http.Request) {
-	// Resolve the correct backend for this domain from Zoraxy's proxy rules.
 	backend := resolveBackend(r.Host)
 	if !strings.HasPrefix(backend, "http") {
 		backend = "http://" + backend
@@ -97,7 +90,6 @@ func proxyToBackend(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Restore the original URI that Zoraxy captured (stripped of /inspect prefix).
 	originalPath := r.Header.Get("X-Zoraxy-Uri")
 	if originalPath == "" {
 		originalPath = r.URL.Path
@@ -116,7 +108,7 @@ func proxyToBackend(w http.ResponseWriter, r *http.Request) {
 	}
 	proxyReq.Header.Set("X-Forwarded-For", r.RemoteAddr)
 
-	client := &http.Client{Timeout: time.Duration(cfg.TimeoutMs) * time.Millisecond}
+	client := &http.Client{Timeout: time.Duration(getConfig().TimeoutMs) * time.Millisecond}
 	resp, err := client.Do(proxyReq)
 	if err != nil {
 		http.Error(w, "backend unreachable", http.StatusBadGateway)