itsi 0.1.19 → 0.2.2

data/crates/itsi_server/src/server/middleware_stack/middlewares/error_response/default_responses.rs

@@ -1,86 +1,85 @@
-use std::convert::Infallible;
-
+use super::{ContentSource, DefaultFormat, ErrorResponse};
+use crate::server::http_message_types::ResponseFormat;
 use bytes::Bytes;
 use http_body_util::{combinators::BoxBody, Full};
-
-use crate::server::http_message_types::ResponseFormat;
-
-use super::{ContentSource, DefaultFormat, ErrorResponse};
+use std::{convert::Infallible, sync::Arc};
 
 impl DefaultFormat {
     pub fn response_for_code(&self, code: u16) -> ContentSource {
         match self {
             DefaultFormat::Plaintext => match code {
-                500 => ContentSource::Inline("500 Internal Error".to_owned()),
-                404 => ContentSource::Inline("404 Not Found".to_owned()),
-                401 => ContentSource::Inline("401 Unauthorized".to_owned()),
-                403 => ContentSource::Inline("403 Forbidden".to_owned()),
-                413 => ContentSource::Inline("413 Payload Too Large".to_owned()),
-                429 => ContentSource::Inline("429 Too Many Requests".to_owned()),
-                502 => ContentSource::Inline("502 Bad Gateway".to_owned()),
-                503 => ContentSource::Inline("503 Service Unavailable".to_owned()),
-                504 => ContentSource::Inline("504 Gateway Timeout".to_owned()),
-                _ => ContentSource::Inline("Unexpected Error".to_owned()),
+                500 => ContentSource::Static(Arc::new("500 Internal Error".into())),
+                404 => ContentSource::Static(Arc::new("404 Not Found".into())),
+                401 => ContentSource::Static(Arc::new("401 Unauthorized".into())),
+                403 => ContentSource::Static(Arc::new("403 Forbidden".into())),
+                413 => ContentSource::Static(Arc::new("413 Payload Too Large".into())),
+                429 => ContentSource::Static(Arc::new("429 Too Many Requests".into())),
+                502 => ContentSource::Static(Arc::new("502 Bad Gateway".into())),
+                503 => ContentSource::Static(Arc::new("503 Service Unavailable".into())),
+                504 => ContentSource::Static(Arc::new("504 Gateway Timeout".into())),
+                _ => ContentSource::Static(Arc::new("Unexpected Error".into())),
             },
             DefaultFormat::Html => match code {
-                500 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/500.html").to_owned(),
-                ),
-                404 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/404.html").to_owned(),
-                ),
-                401 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/401.html").to_owned(),
-                ),
-                403 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/403.html").to_owned(),
-                ),
-                413 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/413.html").to_owned(),
-                ),
-                429 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/429.html").to_owned(),
-                ),
-                502 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/502.html").to_owned(),
-                ),
-                503 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/503.html").to_owned(),
-                ),
-                504 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/html/504.html").to_owned(),
-                ),
-                _ => ContentSource::Inline("Unexpected Error".to_owned()),
+                500 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/500.html").into(),
+                )),
+                404 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/404.html").into(),
+                )),
+                401 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/401.html").into(),
+                )),
+                403 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/403.html").into(),
+                )),
+                413 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/413.html").into(),
+                )),
+                429 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/429.html").into(),
+                )),
+                502 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/502.html").into(),
+                )),
+                503 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/503.html").into(),
+                )),
+                504 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/504.html").into(),
+                )),
+                _ => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/html/500.html").into(),
+                )),
             },
             DefaultFormat::Json => match code {
-                500 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/500.json").to_owned(),
-                ),
-                404 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/404.json").to_owned(),
-                ),
-                401 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/401.json").to_owned(),
-                ),
-                403 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/403.json").to_owned(),
-                ),
-                413 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/413.json").to_owned(),
-                ),
-                429 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/429.json").to_owned(),
-                ),
-                502 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/502.json").to_owned(),
-                ),
-                503 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/503.json").to_owned(),
-                ),
-                504 => ContentSource::Inline(
-                    include_str!("../../../../default_responses/json/504.json").to_owned(),
-                ),
-                _ => ContentSource::Inline("Unexpected Error".to_owned()),
+                500 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/500.json").into(),
+                )),
+                404 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/404.json").into(),
+                )),
+                401 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/401.json").into(),
+                )),
+                403 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/403.json").into(),
+                )),
+                413 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/413.json").into(),
+                )),
+                429 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/429.json").into(),
+                )),
+                502 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/502.json").into(),
+                )),
+                503 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/503.json").into(),
+                )),
+                504 => ContentSource::Static(Arc::new(
+                    include_str!("../../../../default_responses/json/504.json").into(),
+                )),
+                _ => ContentSource::Static(Arc::new("Unexpected Error".into())),
             },
         }
     }
@@ -95,6 +94,9 @@ impl ErrorResponse {
         };
         match source {
             ContentSource::Inline(bytes) => BoxBody::new(Full::new(Bytes::from(bytes))),
+            ContentSource::Static(text) => {
+                BoxBody::new(Full::new(Bytes::from(String::from(text.as_str()))))
+            }
             ContentSource::File(_) => BoxBody::new(Full::new(Bytes::from("Unexpected error"))),
         }
     }

data/crates/itsi_server/src/server/middleware_stack/middlewares/error_response.rs

@@ -5,6 +5,8 @@ use http_body_util::{combinators::BoxBody, Full};
 use serde::{Deserialize, Deserializer};
 use std::convert::Infallible;
 use std::path::PathBuf;
+use std::sync::Arc;
+use tracing::warn;
 
 use crate::server::http_message_types::{HttpResponse, ResponseFormat};
 use crate::services::static_file_server::ROOT_STATIC_FILE_SERVER;
@@ -16,6 +18,9 @@ pub enum ContentSource {
     Inline(String),
     #[serde(rename(deserialize = "file"))]
     File(PathBuf),
+    #[serde(rename(deserialize = "static"))]
+    #[serde(skip_deserializing)]
+    Static(Arc<String>),
 }
 
 #[derive(Debug, Clone, Deserialize, Default)]
@@ -90,7 +95,13 @@ impl From<ErrorResponseDef> for ErrorResponse {
                 "bad_gateway" => ErrorResponse::bad_gateway(),
                 "service_unavailable" => ErrorResponse::service_unavailable(),
                 "gateway_timeout" => ErrorResponse::gateway_timeout(),
-                _ => panic!("Unknown error response name: {}", name),
+                _ => {
+                    warn!(
+                        "Unknown error response name: {}. Using internal server error.",
+                        name
+                    );
+                    ErrorResponse::internal_server_error()
+                }
             },
         }
     }
@@ -139,6 +150,9 @@ impl ErrorResponse {
             Some(ContentSource::Inline(text)) => {
                 return BoxBody::new(Full::new(Bytes::from(text.clone())));
             }
+            Some(ContentSource::Static(text)) => {
+                return BoxBody::new(Full::new(Bytes::from(String::from(text.as_str()))));
+            }
             Some(ContentSource::File(path)) => {
                 // Convert the PathBuf to a &str (assumes valid UTF-8).
                 if let Some(path_str) = path.to_str() {

data/crates/itsi_server/src/server/middleware_stack/middlewares/etag.rs

@@ -15,6 +15,7 @@ use hyper::body::Body;
 use magnus::error::Result;
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
+use tracing::debug;
 
 #[derive(Debug, Clone, Copy, Deserialize, Default)]
 pub enum ETagType {
@@ -60,6 +61,7 @@ impl MiddlewareLayer for ETag {
         // Store if-none-match header in context if present for later use in after hook
         if self.handle_if_none_match {
             if let Some(if_none_match) = req.headers().get(header::IF_NONE_MATCH) {
+                debug!(target: "middleware::etag", "Received If-None-Match header: {:?}", if_none_match);
                 if let Ok(etag_value) = if_none_match.to_str() {
                     context.set_if_none_match(Some(etag_value.to_string()));
                 }
@@ -77,33 +79,35 @@ impl MiddlewareLayer for ETag {
             | StatusCode::NON_AUTHORITATIVE_INFORMATION
             | StatusCode::NO_CONTENT
             | StatusCode::PARTIAL_CONTENT => {}
-            _ => return resp,
+            _ => {
+                debug!(target: "middleware::etag", "Skipping ETag middleware for ineligible response");
+                return resp;
+            }
         }
 
-        // Skip if already has an ETag
         if resp.headers().contains_key(header::ETAG) {
+            debug!(target: "middleware::etag", "Forwarding response with existing ETag");
             return resp;
         }
 
-        // Skip if Cache-Control: no-store is present
         if let Some(cache_control) = resp.headers().get(header::CACHE_CONTROL) {
             if let Ok(cache_control_str) = cache_control.to_str() {
                 if cache_control_str.contains("no-store") {
+                    debug!(target: "middleware::etag", "Skipping ETag for no-store response");
                     return resp;
                 }
             }
         }
 
-        // Check if body is a stream or fixed size using size_hint (similar to compression.rs)
         let body_size = resp.size_hint().exact();
 
-        // Skip streaming bodies
         if body_size.is_none() {
+            debug!(target: "middleware::etag", "Skipping ETag for streaming response");
             return resp;
         }
 
-        // Skip if body is too small
         if body_size.unwrap_or(0) < self.min_body_size as u64 {
+            debug!(target: "middleware::etag", "Skipping ETag for small response");
             return resp;
         }
 
@@ -142,6 +146,7 @@ impl MiddlewareLayer for ETag {
                 ETagType::Weak => format!("W/\"{}\"", computed_etag),
             };
 
+            debug!(target: "middleware::etag", "Computed ETag for response {}", formatted_etag);
             if let Ok(value) = HeaderValue::from_str(&formatted_etag) {
                 parts.headers.insert(header::ETAG, value);
             }
@@ -150,7 +155,6 @@ impl MiddlewareLayer for ETag {
             formatted_etag
         };
 
-        // Handle 304 Not Modified if we have an If-None-Match header and it matches
         if self.handle_if_none_match {
             if let Some(if_none_match) = context.get_if_none_match() {
                 if if_none_match == etag_value || if_none_match == "*" {
@@ -176,7 +180,6 @@ impl MiddlewareLayer for ETag {
             }
         }
 
-        // Recreate response with the original body and the ETag header
         Response::from_parts(parts, body)
     }
 }

data/crates/itsi_server/src/server/middleware_stack/middlewares/intrusion_protection.rs

@@ -4,6 +4,7 @@ use crate::services::rate_limiter::{
     get_ban_manager, get_rate_limiter, BanManager, RateLimiter, RateLimiterConfig,
 };
 
+use super::token_source::TokenSource;
 use super::{ErrorResponse, FromValue, MiddlewareLayer};
 
 use async_trait::async_trait;
@@ -28,12 +29,13 @@ pub struct IntrusionProtection {
     pub banned_header_pattern_matchers: OnceLock<HashMap<String, RegexSet>>,
     #[serde(default)]
     pub banned_header_patterns: HashMap<String, Vec<String>>,
-    pub banned_time_seconds: u64,
+    pub banned_time_seconds: f64,
     #[serde(skip_deserializing)]
     pub rate_limiter: OnceLock<Arc<dyn RateLimiter>>,
     #[serde(skip_deserializing)]
     pub ban_manager: OnceLock<BanManager>,
     pub store_config: RateLimiterConfig,
+    pub trusted_proxies: HashMap<String, TokenSource>,
     #[serde(default = "forbidden_error_response")]
     pub error_response: ErrorResponse,
 }
@@ -49,6 +51,7 @@ impl MiddlewareLayer for IntrusionProtection {
         if !self.banned_url_patterns.is_empty() {
             match RegexSet::new(&self.banned_url_patterns) {
                 Ok(regex_set) => {
+                    debug!(target: "middleware::intrusion_protection", "Compiled URL regex patterns: {} items.", regex_set.len());
                     let _ = self.banned_url_pattern_matcher.set(regex_set);
                 }
                 Err(e) => {
@@ -64,6 +67,7 @@ impl MiddlewareLayer for IntrusionProtection {
                 if !patterns.is_empty() {
                     match RegexSet::new(patterns) {
                         Ok(regex_set) => {
+                            debug!(target: "middleware::intrusion_protection", "Compiled header regex patterns for {}: {} items.", header_name, regex_set.len());
                             header_matchers.insert(header_name.clone(), regex_set);
                         }
                         Err(e) => {
@@ -81,12 +85,14 @@ impl MiddlewareLayer for IntrusionProtection {
         // Initialize rate limiter (used for tracking bans)
         // This will automatically fall back to in-memory if Redis fails
         if let Ok(limiter) = get_rate_limiter(&self.store_config).await {
+            debug!(target: "middleware::intrusion_protection", "Initialized rate limiter.");
             let _ = self.rate_limiter.set(limiter);
         }
 
         // Initialize ban manager
         // This will automatically fall back to in-memory if Redis fails
         if let Ok(manager) = get_ban_manager(&self.store_config).await {
+            debug!(target: "middleware::intrusion_protection", "Initialized ban manager.");
             let _ = self.ban_manager.set(manager);
         }
 
@@ -99,12 +105,18 @@ impl MiddlewareLayer for IntrusionProtection {
         context: &mut HttpRequestContext,
     ) -> Result<Either<HttpRequest, HttpResponse>> {
         // Get client IP address from context's service
-        let client_ip = &context.addr;
+        let client_ip = if self.trusted_proxies.contains_key(&context.addr) {
+            let source = self.trusted_proxies.get(&context.addr).unwrap();
+            source.extract_token(&req).unwrap_or(&context.addr)
+        } else {
+            &context.addr
+        };
 
         // Check if the IP is already banned
         if let Some(ban_manager) = self.ban_manager.get() {
             match ban_manager.is_banned(client_ip).await {
                 Ok(Some(_)) => {
+                    debug!(target: "middleware::intrusion_protection", "IP {} is banned.", client_ip);
                     return Ok(Either::Right(
                         self.error_response
                             .to_http_response(req.accept().into())
@@ -115,9 +127,7 @@ impl MiddlewareLayer for IntrusionProtection {
                     error!("Error checking IP ban status: {:?}", e);
                     // Continue processing - fail open
                 }
-                _ => {
-                    // Not banned, continue with intrusion checks
-                }
+                _ => {}
             }
         } else {
             warn!("No ban manager available for intrusion protection");
@@ -128,12 +138,13 @@ impl MiddlewareLayer for IntrusionProtection {
             let path = req.uri().path_and_query().map(|p| p.as_str()).unwrap_or("");
 
             if url_matcher.is_match(path) {
+                debug!(target: "middleware::intrusion_protection", "Banned URL pattern detected: {}", path);
                 if let Some(ban_manager) = self.ban_manager.get() {
                     match ban_manager
                         .ban_ip(
                             client_ip,
                             &format!("Banned URL pattern detected: {}", path),
-                            Duration::from_secs(self.banned_time_seconds),
+                            Duration::from_secs_f64(self.banned_time_seconds),
                         )
                         .await
                     {
@@ -156,10 +167,7 @@ impl MiddlewareLayer for IntrusionProtection {
             for (header_name, pattern_set) in header_matchers {
                 if let Some(header_value) = req.header(header_name) {
                     if pattern_set.is_match(header_value) {
-                        info!(
-                            "Intrusion detected: Header pattern match for {} in header {}",
-                            header_value, header_name
-                        );
+                        debug!(target: "middleware::intrusion_protection", "Banned header pattern detected: {} in {}", header_value, header_name);
 
                         // Ban the IP address if possible
                         if let Some(ban_manager) = self.ban_manager.get() {
@@ -170,7 +178,7 @@ impl MiddlewareLayer for IntrusionProtection {
                                         "Banned header pattern detected: {} in {}",
                                         header_value, header_name
                                     ),
-                                    Duration::from_secs(self.banned_time_seconds),
+                                    Duration::from_secs_f64(self.banned_time_seconds),
                                 )
                                 .await
                             {

data/crates/itsi_server/src/server/middleware_stack/middlewares/log_requests.rs

@@ -42,11 +42,11 @@ pub enum LogMiddlewareLevel {
 impl LogMiddlewareLevel {
     pub fn log(&self, message: String) {
         match self {
-            LogMiddlewareLevel::Trace => trace!(message),
-            LogMiddlewareLevel::Debug => debug!(message),
-            LogMiddlewareLevel::Info => info!(message),
-            LogMiddlewareLevel::Warn => warn!(message),
-            LogMiddlewareLevel::Error => error!(message),
+            LogMiddlewareLevel::Trace => trace!(target: "middleware::log_requests", message),
+            LogMiddlewareLevel::Debug => debug!(target: "middleware::log_requests", message),
+            LogMiddlewareLevel::Info => info!(target: "middleware::log_requests", message),
+            LogMiddlewareLevel::Warn => warn!(target: "middleware::log_requests", message),
+            LogMiddlewareLevel::Error => error!(target: "middleware::log_requests", message),
         }
     }
 }

data/crates/itsi_server/src/server/middleware_stack/middlewares/max_body.rs

@@ -13,7 +13,7 @@ use std::sync::atomic::Ordering;
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct MaxBody {
-    pub max_size: usize,
+    pub limit_bytes: usize,
     #[serde(default = "payload_too_large_error_response")]
     pub error_response: ErrorResponse,
 }
@@ -29,7 +29,7 @@ impl MiddlewareLayer for MaxBody {
         req: HttpRequest,
         context: &mut HttpRequestContext,
     ) -> Result<Either<HttpRequest, HttpResponse>> {
-        req.body().limit.store(self.max_size, Ordering::Relaxed);
+        req.body().limit.store(self.limit_bytes, Ordering::Relaxed);
         context.set_response_format(req.accept().into());
         Ok(Either::Left(req))
     }

data/crates/itsi_server/src/server/middleware_stack/middlewares/mod.rs

@@ -5,6 +5,7 @@ mod auth_jwt;
 mod cache_control;
 mod compression;
 mod cors;
+mod csp;
 mod deny_list;
 mod error_response;
 mod etag;
@@ -23,6 +24,9 @@ mod static_response;
 mod string_rewrite;
 mod token_source;
 
+use std::sync::Arc;
+use std::sync::LazyLock;
+
 pub use allow_list::AllowList;
 use async_trait::async_trait;
 pub use auth_api_key::AuthAPIKey;
@@ -32,6 +36,7 @@ pub use cache_control::CacheControl;
 pub use compression::Compression;
 pub use compression::CompressionAlgorithm;
 pub use cors::Cors;
+pub use csp::Csp;
 pub use deny_list::DenyList;
 use either::Either;
 pub use error_response::ErrorResponse;
@@ -39,6 +44,7 @@ pub use etag::ETag;
 pub use intrusion_protection::IntrusionProtection;
 pub use log_requests::LogRequests;
 use magnus::error::Result;
+use magnus::rb_sys::AsRawValue;
 use magnus::Value;
 pub use max_body::MaxBody;
 pub use proxy::Proxy;
@@ -51,17 +57,40 @@ use serde::Deserialize;
 use serde_magnus::deserialize;
 pub use static_assets::StaticAssets;
 pub use static_response::StaticResponse;
+pub use string_rewrite::StringRewrite;
 
 use crate::server::http_message_types::HttpRequest;
 use crate::server::http_message_types::HttpResponse;
 use crate::services::itsi_http_service::HttpRequestContext;
 
+use std::collections::HashMap;
+use std::sync::Mutex;
+static CACHE: LazyLock<Mutex<HashMap<u64, Arc<dyn std::any::Any + Send + Sync>>>> =
+    LazyLock::new(|| Mutex::new(HashMap::new()));
+
+pub fn clear_value_cache() {
+    let mut cache = CACHE.lock().unwrap();
+    cache.clear();
+}
+
 pub trait FromValue: Sized + Send + Sync + 'static {
-    fn from_value(value: Value) -> Result<Self>
+    fn from_value(value: Value) -> Result<Arc<Self>>
     where
         Self: Deserialize<'static>,
     {
-        deserialize(value)
+        let raw = value.as_raw();
+
+        let mut cache = CACHE.lock().unwrap();
+
+        if let Some(cached) = cache.get(&raw) {
+            if let Some(deserialized) = cached.downcast_ref::<Arc<Self>>() {
+                return Ok(deserialized.clone());
+            }
+        }
+
+        let deserialized: Arc<Self> = Arc::new(deserialize(value)?);
+        cache.insert(raw, deserialized.clone());
+        Ok(deserialized)
     }
 }
 

data/crates/itsi_server/src/server/middleware_stack/middlewares/proxy.rs

@@ -33,13 +33,14 @@ use reqwest::{
     Body, Client, Url,
 };
 use serde::Deserialize;
+use tracing::{debug, info};
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct Proxy {
     pub to: StringRewrite,
     pub backends: Vec<String>,
     pub backend_priority: BackendPriority,
-    pub headers: HashMap<String, Option<ProxiedHeader>>,
+    pub headers: HashMap<String, Option<StringRewrite>>,
     pub verify_ssl: bool,
     pub timeout: u64,
     pub tls_sni: bool,
@@ -63,23 +64,6 @@ pub enum BackendPriority {
     Random,
 }
 
-#[derive(Debug, Clone, Deserialize)]
-pub enum ProxiedHeader {
-    #[serde(rename(deserialize = "value"))]
-    String(String),
-    #[serde(rename(deserialize = "rewrite"))]
-    StringRewrite(StringRewrite),
-}
-
-impl ProxiedHeader {
-    pub fn to_string(&self, req: &HttpRequest, context: &HttpRequestContext) -> String {
-        match self {
-            ProxiedHeader::String(value) => value.clone(),
-            ProxiedHeader::StringRewrite(rewrite) => rewrite.rewrite_request(req, context),
-        }
-    }
-}
-
 #[derive(Debug, Clone)]
 pub struct Resolver {
     backends: Arc<Vec<SocketAddr>>,
@@ -164,7 +148,7 @@ impl Proxy {
         for (name, header_opt) in self.headers.iter() {
             if let Some(header_value) = header_opt {
                 // Compute the header value using the full HttpRequest.
-                let value_str = header_value.to_string(req, context);
+                let value_str = header_value.rewrite_request(req, context);
                 if let Ok(header_val) = http::HeaderValue::from_str(&value_str) {
                     if let Ok(header_name) = name.parse::<http::header::HeaderName>() {
                         headers.insert(header_name, header_val);
@@ -201,6 +185,7 @@ impl Proxy {
 
         // Add a Host header if not overridden.
         if !overriding_headers.contains_key("host") && !host_str.is_empty() {
+            debug!("Adding Host header: {}", host_str);
             builder = builder.header("Host", host_str);
         }
 
@@ -231,6 +216,7 @@ impl Proxy {
                 Err(e) => {
                     // Retry for connectivity-related errors.
                     if e.is_connect() {
+                        debug!(target: "middleware::proxy", "Connection error, retrying");
                         last_err = Some(e);
                         if attempt + 1 < max_attempts {
                             continue;
@@ -278,6 +264,7 @@ impl MiddlewareLayer for Proxy {
                 }
             })
             .collect::<Vec<_>>();
+        debug!(target: "middleware::proxy", "backends: {:?}", backends);
 
         self.client
             .set(
@@ -314,14 +301,20 @@ impl MiddlewareLayer for Proxy {
         context: &mut HttpRequestContext,
     ) -> Result<Either<HttpRequest, HttpResponse>> {
         let url = self.to.rewrite_request(&req, context);
+
         let accept: ResponseFormat = req.accept().into();
         let error_response = self.error_response.to_http_response(accept.clone()).await;
 
         let destination = match Url::parse(&url) {
             Ok(dest) => dest,
-            Err(_) => return Ok(Either::Right(error_response)),
+            Err(_) => {
+                debug!(target: "middleware::proxy", "Failed to parse URL: {}", url);
+                return Ok(Either::Right(error_response));
+            }
         };
 
+        debug!(target: "middleware::proxy", "Proxying to: {:?}", destination);
+
         // Clone the headers before consuming the request.
         let req_headers = req.headers().clone();
         let host_str = destination.host_str().unwrap_or_else(|| {
@@ -331,6 +324,7 @@ impl MiddlewareLayer for Proxy {
                 .unwrap_or("")
         });
 
+        info!("Extracted host str is {}", host_str);
         let req_info = RequestInfo {
             method: req.method().clone(),
             headers: req_headers.clone(),
@@ -373,6 +367,8 @@ impl MiddlewareLayer for Proxy {
 
         let response = match reqwest_response_result {
             Ok(response) => {
+                debug!(target: "middleware::proxy", "Response {} received", response.status());
+
                 let status = response.status();
                 let mut builder = Response::builder().status(status);
                 for (hn, hv) in response.headers() {
@@ -387,6 +383,7 @@ impl MiddlewareLayer for Proxy {
                 response.unwrap_or(error_response)
             }
             Err(e) => {
+                debug!(target: "middleware::proxy", "Error {:?} received", e);
                 if let Some(inner) = e.source() {
                     if inner.downcast_ref::<MaxBodySizeReached>().is_some() {
                         let mut max_body_response = Response::new(BoxBody::new(Empty::new()));