Update index.php

index.php

@@ -1,14 +1,14 @@
 <?php
-// By: Colime – PHP version for Hugging Face Spaces
+// By: Colime – PHP reverse proxy, tuned for Google
 
-// Handle root
+// Root page
 if ($_SERVER['REQUEST_URI'] === '/' || $_SERVER['REQUEST_URI'] === '') {
     header('Content-Type: text/html; charset=utf-8');
     echo '<p>about:blank</p>';
     exit;
 }
 
-// Handle CORS preflight
+// CORS preflight
 if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
     http_response_code(204);
     header('Access-Control-Allow-Origin: *');
@@ -39,16 +39,45 @@ if (!$parts || !isset($parts['host'])) {
 $requestHeaders = getallheaders();
 $forwardHeaders = [];
 
+// Hop-by-hop headers that should NOT be forwarded (both request and response)
+$hopByHop = [
+    'connection', 'keep-alive', 'proxy-authenticate',
+    'proxy-authorization', 'te', 'trailer', 'transfer-encoding',
+    'upgrade'
+];
+
 foreach ($requestHeaders as $name => $value) {
     $lower = strtolower($name);
-    // Drop Cloudflare headers and the original Host
+    // Drop Cloudflare headers, real IP, and original Host
     if (strpos($lower, 'cf-') === 0 || $lower === 'x-real-ip' || $lower === 'host') {
         continue;
     }
+    // Don't forward hop-by-hop request headers
+    if (in_array($lower, $hopByHop)) {
+        continue;
+    }
+    // Accept-Encoding is handled by cURL automatically; do not forward it
+    if ($lower === 'accept-encoding') {
+        continue;
+    }
     $forwardHeaders[] = "$name: $value";
 }
+
+// Set the target host
 $forwardHeaders[] = 'Host: ' . $parts['host'];
 
+// Fallback User-Agent (only if client didn't send one)
+$hasUserAgent = false;
+foreach ($forwardHeaders as $h) {
+    if (stripos($h, 'User-Agent:') === 0) {
+        $hasUserAgent = true;
+        break;
+    }
+}
+if (!$hasUserAgent) {
+    $forwardHeaders[] = 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36';
+}
+
 // cURL request
 $ch = curl_init($target);
 curl_setopt_array($ch, [
@@ -56,11 +85,13 @@ curl_setopt_array($ch, [
     CURLOPT_HTTPHEADER     => $forwardHeaders,
     CURLOPT_RETURNTRANSFER => true,
     CURLOPT_FOLLOWLOCATION => true,
-    CURLOPT_HEADER         => true,   // return headers + body
+    CURLOPT_HEADER         => true,       // include headers in output
     CURLOPT_TIMEOUT        => 30,
+    CURLOPT_ENCODING       => '',         // accept any compression, decompress automatically
+    CURLOPT_SSL_VERIFYPEER => true,       // keep enabled (HF has CA certs)
 ]);
 
-// Forward request body for methods that may have one
+// Forward request body (if any)
 $body = file_get_contents('php://input');
 if ($body !== '' && $body !== false) {
     curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
@@ -78,22 +109,25 @@ if ($error) {
 }
 
 // Split headers and body
-$headerSize    = $info['header_size'];
+$headerSize      = $info['header_size'];
 $responseHeaders = substr($response, 0, $headerSize);
 $responseBody    = substr($response, $headerSize);
 
-// Parse response headers (skip Transfer-Encoding notes, no need to change)
+// Parse incoming response headers
 $headersArr = explode("\r\n", $responseHeaders);
 $statusCode = 200;
-$outHeaders = []; // list of [name, value]
+$outHeaders = []; // name -> value pairs (duplicates allowed, but we'll filter some)
 
 foreach ($headersArr as $line) {
+    // Status line
     if (stripos($line, 'HTTP/') === 0) {
         preg_match('/\d{3}/', $line, $m);
         $statusCode = (int)($m[0] ?? 200);
         continue;
     }
-    if (trim($line) === '') continue;
+    if (trim($line) === '') {
+        continue;
+    }
 
     $colon = strpos($line, ':');
     if ($colon !== false) {
@@ -101,18 +135,27 @@ foreach ($headersArr as $line) {
         $value = trim(substr($line, $colon + 1));
         $lower = strtolower($name);
 
-        // Remove security headers that could block display
+        // Remove security headers that block iframes
         if ($lower === 'content-security-policy' || $lower === 'x-frame-options') {
             continue;
         }
+        // Remove hop-by-hop response headers
+        if (in_array($lower, $hopByHop)) {
+            continue;
+        }
+        // cURL already decompressed the body – remove Content-Encoding
+        if ($lower === 'content-encoding') {
+            continue;
+        }
+
         $outHeaders[] = [$name, $value];
     }
 }
 
-// --- Output final response ---
+// --- Send final response ---
 http_response_code($statusCode);
 
-// CORS + no-cache
+// Always add CORS and no-cache headers
 header('Access-Control-Allow-Origin: *');
 header('Access-Control-Allow-Methods: *');
 header('Access-Control-Allow-Headers: *');
@@ -120,7 +163,7 @@ header('Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate');
 header('Pragma: no-cache');
 header('Expires: 0');
 
-// Forward upstream headers
+// Forward upstream headers (except those we filtered out)
 foreach ($outHeaders as $h) {
     header($h[0] . ': ' . $h[1]);
 }