Filter requests

Job: replay only the API, or drop health checks and admin, before traffic hits staging.

sudo gor --input-raw :8080 --output-http="http://staging.example.com" --http-allow-url /api

URL filters match the full URL including host (regexp).

# drop matching URLs
sudo gor --input-raw :8080 --output-http="http://staging.example.com" --http-disallow-url /health

# method whitelist (repeat the flag)
sudo gor --input-raw :8080 --output-http="http://staging.example.com" \
  --http-allow-method GET --http-allow-method OPTIONS

# header must match
sudo gor --input-raw :8080 --output-http="http://staging.example.com" --http-allow-header 'api-version:^v1'

# header match is dropped
sudo gor --input-raw :8080 --output-http="http://staging.example.com" --http-disallow-header "User-Agent: Replayed by Gor"

# decoded basic-auth string must match
sudo gor --input-raw :8080 --output-http="http://staging.example.com" --http-basic-auth-filter "^customer[0-9].*"

Hash sampling (stable per user): --http-header-limiter user-id:25% and --http-param-limiter user_id:25%. Plugin-level |10 / |10% is documented in the basics.

Need body logic or token maps? middleware.

Rewrite Host, URL, and headers next.