GTranslate Proxy

GTranslate Proxy is an add-on for the
GTranslate module.
It proxies language-prefixed paths (e.g. /es/about-us) to
GTranslate's Translation Delivery Network (TDN), adds a caching layer,
enforces security controls around which paths and languages can be
translated, and supports GTranslate's in-context translation editor
through a pluggable, hosting-agnostic cookie transport.

Why this module exists

GTranslate's default integration path (its widget plus a
.htaccess-based rewrite rule, or an equivalent snippet in
settings.php) works, but it has some rough edges that
surface hard at scale:

• Every enabled language is a new crawlable surface.
  Out of the box, GTranslate ships with close to 100 languages available.
  Leaving them all enabled means every page on the site effectively
  multiplies into ~100 translated URL variants. Bots and scanners
  discover and hammer these variants relentlessly, and because each
  request was a live round trip to GTranslate, this was enough on its
  own to drive a production site offline. This module treats the
  enabled-language list (still configured on the GTranslate module
  itself) as a strict allowlist, and adds path-based blocking and
  malicious-pattern detection on top.
• No caching, by design. The .htaccess
  rewrite pattern GTranslate documents issues a fresh HTTP request to
  GTranslate's TDN on every single hit to a translated path,
  with no caching layer in front of it. Under any real traffic
  (let alone bot traffic), that means constant outbound requests for
  identical content. This module caches translated responses, purges
  automatically on content update, and only bypasses the cache for
  genuinely uncacheable requests (translation-editor sessions,
  CSRF-bearing form submissions, and similar).
• .htaccess doesn't even work everywhere.
  Platforms such as Pantheon run nginx and never process
  .htaccess at all. The common workaround is to
  hand-roll the same rewrite logic inside settings.php,
  which mixes routing behavior into bootstrap configuration and is
  difficult to test or reason about. This module replaces both
  approaches with a normal Drupal event subscriber and a small set of
  injectable services, so the behavior is testable, cacheable, and
  portable across hosting platforms.

What it does

• Intercepts language-prefixed paths before Drupal's router and proxies
  them to GTranslate's TDN.
• Caches translated responses, with automatic invalidation on content
  update/delete and an optional manual cache-bust token.
• Reads the enabled-language list and source language directly from the
  GTranslate module's own configuration — this module never duplicates or
  overrides that configuration.
• Blocks known-sensitive paths (admin routes, edit forms, etc.) and
  detects path-traversal / malicious-pattern attempts before any upstream
  request is made.
• Rewrites GTranslate's subdomain-based URLs to this site's path-based
  structure, across anchors, form actions, and redirects.
• Supports GTranslate's in-context translation editor
  (?language_edit=1 and the tdn-bin API family),
  including POST body/header forwarding and multi
  Set-Cookie handling.
• Ships a development/mock mode that mimics GTranslate's output locally,
  without calling the real API.

Editor cookie transport

GTranslate's editor tracks login/session state via cookies set on
GTranslate's own domain, which have to cross the proxy boundary in both
directions. Hosting platforms and CDNs handle arbitrary cookies
differently — some strip anything they don't recognize — so this module
makes the transport a pluggable strategy, selectable from the settings
form:

• Direct — forwards cookies unmodified; simplest option
  where the host/CDN preserves arbitrary cookie names.
• Pantheon — aliases cookies with a Pantheon-compatible
  STYXKEY_* prefix and restores the original name upstream.
• Session (recommended default) — stores upstream
  cookies server-side in the Drupal session; the browser only ever sees
  Drupal's own session cookie. Portable across any host or CDN with no
  cookie-name allowlisting required.
• Configurable prefix — a generic version of the
  Pantheon strategy for other CDNs with their own allowlisted prefix.

Drupal SESS*/SSESS* cookies are never forwarded
upstream, regardless of transport, and a built-in, sanitized diagnostics
panel flags when an edge platform is silently dropping the editor's
cookies.

Security

• Editor traffic is always served private, no-store; only
  ordinary translated pages are cached and served publicly.
• TLS certificate verification for upstream requests is on by default;
  disabling it is an explicit, discouraged, clearly-labeled setting.
• Cookie values, authorization headers, and tokens are never logged —
  only cookie/header names, for diagnostics.

Requirements

• GTranslate
  (this module depends on it for the widget and language configuration).
• Drupal 10.3+ or Drupal 11.

Note: editing translations in-place via GTranslate's editor
typically requires a paid GTranslate service plan. This module proxies
editor traffic faithfully but does not itself grant access to that
feature.