cclohmar/zoraxy-waf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: restore proxyToBackend — header approach was returning empty 200

Browse source
This commit is contained in:
Claus Lohmar 2026-08-07 14:40:10 +00:00
parent 8b3bb93be3
commit d2fd6edd3a
1 changed files with 5 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
middleware.go
View file

@ -45,16 +45,14 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
if !cfg.Enabled { if !cfg.Enabled {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
w.Header().Set("X-Zoraxy-Status", "unhandled") proxyToBackend(w, r)
w.WriteHeader(http.StatusOK)
return return
} }
if breaker.State() == StateOpen { if breaker.State() == StateOpen {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
log.Printf("Firewall: breaker OPEN — fail-open %s %s", r.Method, r.URL.Path) log.Printf("Firewall: breaker OPEN — fail-open %s %s", r.Method, r.URL.Path)
w.Header().Set("X-Zoraxy-Status", "unhandled") proxyToBackend(w, r)
w.WriteHeader(http.StatusOK)
return return
} }
@ -63,8 +61,7 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
log.Printf("Firewall: inspection error — fail-open: %v", err) log.Printf("Firewall: inspection error — fail-open: %v", err)
breaker.RecordFailure() breaker.RecordFailure()
w.Header().Set("X-Zoraxy-Status", "unhandled") proxyToBackend(w, r)
w.WriteHeader(http.StatusOK)
return return
} }
@ -79,14 +76,10 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
} }
atomic.AddUint64(&requestsAllowed, 1) atomic.AddUint64(&requestsAllowed, 1)
w.Header().Set("X-Zoraxy-Status", "unhandled") proxyToBackend(w, r)
w.WriteHeader(http.StatusOK)
} }
// proxyToBackend forwards the request to Zoraxy's original upstream.
// The original target is passed by Zoraxy via the X-Zoraxy-Uri header.
func proxyToBackend(w http.ResponseWriter, r *http.Request) { func proxyToBackend(w http.ResponseWriter, r *http.Request) {
// Resolve the correct backend for this domain from Zoraxy's proxy rules.
backend := resolveBackend(r.Host) backend := resolveBackend(r.Host)
if !strings.HasPrefix(backend, "http") { if !strings.HasPrefix(backend, "http") {
backend = "http://" + backend backend = "http://" + backend
@ -97,7 +90,6 @@ func proxyToBackend(w http.ResponseWriter, r *http.Request) {
return return
} }
// Restore the original URI that Zoraxy captured (stripped of /inspect prefix).
originalPath := r.Header.Get("X-Zoraxy-Uri") originalPath := r.Header.Get("X-Zoraxy-Uri")
if originalPath == "" { if originalPath == "" {
originalPath = r.URL.Path originalPath = r.URL.Path
@ -116,7 +108,7 @@ func proxyToBackend(w http.ResponseWriter, r *http.Request) {
} }
proxyReq.Header.Set("X-Forwarded-For", r.RemoteAddr) proxyReq.Header.Set("X-Forwarded-For", r.RemoteAddr)
client := &http.Client{Timeout: time.Duration(cfg.TimeoutMs) * time.Millisecond} client := &http.Client{Timeout: time.Duration(getConfig().TimeoutMs) * time.Millisecond}
resp, err := client.Do(proxyReq) resp, err := client.Do(proxyReq)
if err != nil { if err != nil {
http.Error(w, "backend unreachable", http.StatusBadGateway) http.Error(w, "backend unreachable", http.StatusBadGateway)