504 Gateway Timeout (sHVN)

Hi everyone,

I have some strange behavior. Everything is working except the request to “/api/auth/GetFirstAuthentication” leading to 504 Gateway Timeout.

The log says:

<134>Jul  4 15:43:29 haproxy[8]: 172.30.0.1:35538 [04/Jul/2022:15:42:59.142] pub1~ app1/pws-srv1 0/0/0/-1/30050 504 198 - - sHVN 1/1/0/0/0 0/0 "POST https://localhost/api/auth/GetFirstAuthentication HTTP/2.0"

In case you wonder why localhost, I am using haproxy docker container before pushing to live.

As I found here, it looks like the backend application does send some kind of malformed or incomplete headers.

The backend app is in fact behind an IIS which is reverse-proxying the requests for '/, /api, /...' to different ports of the backend app itself.

Any ideas how to troubleshoot or overcome this?

full haproxy.cfg
# HAProxy version 2.6.1-f6ca66d, released 2022/06/21
# config based on the example cfg

# set block wide defaults
defaults
  log global

# The global section deals with process-wide settings (security, resource usage)
global
	# all file names are relative to the directory containing this config
	# file by default
	default-path config

	# refuse to start if any warning is emitted at boot (keep configs clean)
	zero-warning

	# Security hardening: isolate and drop privileges
	chroot /var/empty
	user haproxy
	group haproxy

	# daemonize
	daemon
	pidfile /var/run/haproxy-svc1.pid

	# do not keep old processes longer than that after a reload
	hard-stop-after 5m

	# The command-line-interface (CLI) used by the admin, by provisionning
	# tools, and to transfer sockets during reloads
	stats socket /var/run/haproxy-svc1.sock level admin mode 600 user haproxy expose-fd listeners
	stats timeout 1h

	# send logs to stderr for logging via the service manager
	log stderr local0
	#log stdout format raw local0

	# intermediate security for SSL, from https://ssl-config.mozilla.org/
	ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
	ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

# default settings common to all HTTP proxies below
defaults http
	mode http
	option httplog
	log global
	timeout client 30s
	timeout server 30s
	timeout connect 10s
	timeout http-keep-alive 2m
	timeout queue 15s
	timeout tunnel 4h  # for websocket

# provide a stats page on port 8181
frontend stats
	bind :8181
	# provide advanced stats (ssl, h2, ...)
	stats uri /
	stats show-modules
	stats refresh 5s
	# some users may want to protect the access to their stats and/or to
	# enable admin mode on the page from local networks
	#  stats auth admin:mystats
	#  stats admin if { src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.0/8 }

# First incoming public service. Supports HTTP/1.x and HTTP/2, using HSTS,
# redirects clear to TLS. Uses a dedicated host name for the stats page.
frontend pub1
	bind :80 name clear
	bind :443 name secure ssl crt /certs/localhost.pem alpn h2,http/1.1 # change certificate file name
	option socket-stats  # provide per-bind line stats

	# set HSTS for one year after all responses
	#http-after-response set-header Strict-Transport-Security "max-age=31536000" # only for production
	http-request redirect scheme https code 301 if !{ ssl_fc }

	# silently ignore connect probes and pre-connect without request
	option http-ignore-probes

	# pass client's IP address to the server and prevent against attempts
	# to inject bad contents
	http-request del-header x-forwarded-for
	option forwardfor

	# enable HTTP compression of text contents
	compression algo deflate gzip
	compression type text/ application/javascript application/xhtml+xml image/x-icon

	# enable HTTP caching of any cacheable content
    http-request  cache-use cache
    http-response cache-store cache

	# remove server headers for security hardening
	http-response del-header (Server|X-info)

	default_backend app1

# The cache instance used by the frontend (200MB, 10MB max object, 1 hour max)
# May be consulted using "show cache" on the CLI socket
cache cache
	total-max-size 200        # RAM cache size in megabytes
	max-object-size 10485760  # max cacheable object size in bytes
	max-age 3600              # max cache duration in seconds
	process-vary on           # handle the Vary header (otherwise don't cache)

# First application
backend app1
	# Algorithm:
	#  - roundrobin is usually better for short requests,
	#  - leastconn is better for mixed slow ones, and long transfers,
	#  - random is generally good when using multiple load balancers
	balance roundrobin

	# abort if the client clicks on stop.
	option abortonclose

	# insert a session cookie for user stickiness
	cookie app1 insert indirect nocache

	# check the servers' health using HTTP requests (change hostname)
	option httpchk
	http-check send meth GET uri / ver HTTP/1.1 hdr host lab.local

	# do not overload the servers (100 concurrent conns max each)
	server app-srv1 10.1.50.223:80 cookie app-srv1 maxconn 100 check inter 1s

Thanks in advance!