0.29.7

src/proxy/forward/success_prepare.rs

@@ -333,6 +333,33 @@ let mut response = if h3_tunnel {
     }
     Response::from_parts(parts, Body::new(body))
 };
+// The upstream HTTP client returns Response<hyper::body::Incoming>. Adapt it
+// before rendering a RustProxy error page, so HTTP/2 WebSocket tunnels can
+// continue using the original Incoming body without type erasure.
+// An internal named-location fallback has already won earlier in response.rs.
+let intercept_origin_error = !route.internal && route.frontend.as_ref().is_some_and(|frontend| {
+    frontend.pages.intercept_statuses.contains(&response.status().as_u16())
+});
+// Mark every upstream response as application-supplied, even if this vhost
+// does not intercept its status. The observer must not overwrite it merely
+// because a global 404/5xx error page exists.
+response = intercept_route_origin_error(response, route, &snapshot);
+if intercept_origin_error {
+    // The earlier response rules modified the original origin headers;
+    // reapply them to the newly rendered page so the vhost's header policy
+    // remains effective. Do not allow a custom header rule to cache errors.
+    apply_response_rules(
+        response.headers_mut(),
+        &snapshot,
+        route.frontend.as_deref(),
+        Some(route),
+        admin_control_plane,
+    );
+    response.headers_mut().insert(
+        "cache-control",
+        HeaderValue::from_static("no-store"),
+    );
+}
 response.extensions_mut().insert(ResponseRulesApplied);
 response
     .extensions_mut()