GraphQL: Missing X-gotestwaf-test header (and other headers)

[bedis]

Hi there,

Thx a lot for this wonderful tool!
I'm using gotestwaf to test some ruleset and I use the addDebugHeader CLI option so I can monitor the impact of ruleset update and have a consistent "uuid" to check on (whether given ruleset blocked or not said type of request).

I remarked than some HTTP requests don't have the X-gotestwaf-test header and when I check them, they're all related to graphql. Example URIs:

• /graphql?query=%7B__typename%7D
• /_graphql?query=%7B__typename%7D
• /api/graphql?query=%7B__typename%7D
• /GraphQL?query=%7B__typename%7D

I also remarked the graphql client does not send any headers configured:

• header sent by graphql client:

host: waf:80
user-agent: Go-http-client/1.1
accept-encoding: gzip

• header sent for other requests:

host: waf:80
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US;q=0.8,en;q=0.7
cache-control: no-cache
pragma: no-cache
sec-ch-ua: \"Chromium\";v=\"122\", \"Not(A:Brand\";v=\"24\", \"Google Chrome\";v=\"122\"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: \"Windows\"
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1

I'm using latest version of gotestwaf.