0.34.6_repo_cleanup

src/proxy/forward_entry.rs

@@ -89,10 +89,6 @@ async fn forward_request(
         .cloned()
         .unwrap_or_else(|| state.config.load_full());
     let internal_dispatch = request.extensions().get::<InternalFallbackRoute>().cloned();
-    // Retain the original URI's shared backing bytes independently of `request`.
-    // A normalized, already-safe path can then be borrowed for the entire
-    // forwarding operation, even after the request URI/headers are rewritten.
-    // Encoded/slash-folded paths still allocate via the strict decoder.
     let routing_uri = request.uri().clone();
     let path = if let Some(path) = decoded_path.as_deref() {
         std::borrow::Cow::Borrowed(path)
@@ -108,12 +104,8 @@ async fn forward_request(
     let frontend = if let Some(selection) = &selected_context {
         selection.frontend.as_ref()
     } else {
-        // Internal error fallback calls forward_request directly, without
-        // rerunning the observation middleware.
         snapshot.frontend(&host, local.0, tls)
     };
-    // Host-level denylist: before cache, custom locations, redirects, local
-    // Web Server/PHP-FPM, or any origin connection. No request body is parsed.
     if frontend.is_some_and(|item| item.content_type_policy.blocks(request.headers())) {
         return error(
             StatusCode::FORBIDDEN,
@@ -132,8 +124,6 @@ async fn forward_request(
         handshake.is_some() && frontend.is_some_and(|frontend| frontend.websocket_legacy_support);
     let redirect = snapshot.redirect_on(&host, &path, local.0, tls);
     let local_host = snapshot.not_found_host_on(&host, local.0, tls);
-    // TLS ALPN normally prevents HTTP/2 from reaching a frontend that disabled it.
-    // Keep this request-level guard for coalesced/reused connections and direct tests.
     if request.version() == Version::HTTP_2
         && (frontend.is_some_and(|frontend| !frontend.http2_enabled)
             || redirect.is_some_and(|(redirect, _)| !redirect.http2_enabled)
@@ -227,18 +217,12 @@ async fn forward_request(
             cloudflare_country = crate::forwarding::cloudflare_country(request.headers(), peer.0);
         }
     }
-    // `observe` already stored the actual transport peer.  Most requests
-    // don't use a trusted forwarding hop, so avoid formatting the same IP
-    // and taking the per-request mutex a second time.  IPv4-mapped peers
-    // still take this path so their canonical form is correctly logged.
     if context.client_ip != peer.0.ip() {
         if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
             *exchange.client_ip.lock().unwrap_or_else(|e| e.into_inner()) =
                 Some(context.client_ip.to_string());
         }
     }
-    // GeoIP stays off the normal request path. Resolve lazily for any vhost or
-    // location policy that actually needs a country code, or for log capture.
     let capture_country = state.logs.capture_country();
     let mut country_resolved = false;
     let mut country: Option<String> = None;
@@ -298,9 +282,6 @@ async fn forward_request(
             }
         }
     }
-    // Global host ACLs remain an independent restrictive scope and also apply to
-    // maintenance/fallback/direct-IP responses. Profile/vhost IP+country policy
-    // was evaluated above as one scope each.
     if !snapshot.host_allowed(&host, context.client_ip) {
         return error(
             StatusCode::FORBIDDEN,
@@ -384,17 +365,10 @@ async fn forward_request(
             );
         }
     }
-    // Normal routes almost never have an internal error fallback. Do not copy
-    // the complete HeaderMap and request metadata when no fallback exists.
     let fallback_request = selected
         .filter(|route| route.error_fallback.is_some())
         .map(|_| ErrorFallbackRequest::capture(&request, &snapshot));
-    // The admin cookie is never ordinary application state. Strip it BEFORE
-    // auth/cache and keep only the removed fragment locally. A verified self-admin
-    // backend may restore it after the actual upstream has been selected.
     let admin_cookie = headers::strip_admin_cookie(request.headers_mut());
-    // This is internal authorization, not a public /tinyauth location. It runs
-    // before origin selection, static responses, upgrades and every cache lookup.
     let basic_identity = if let Some(auth) = frontend.and_then(|f| f.basic_auth.as_ref()) {
         match auth
             .authorize(