Haproxy throwing 502

We are getting 502 errors from HAproxy sayingthe server returned an invalid or incomplete response. In the haproxy logs, it has code PH which when looked into, it said The proxy blocked the server’s response, because it was invalid,
incomplete, dangerous (cache control), or matched a security filter.
In any case, an HTTP 502 error is sent to the client. One possible
cause for this error is an invalid syntax in an HTTP header name
containing unauthorized characters.

We also noticed that the request didn’t get logged at the server end. Maybe we didn’t have enough logging implemented but we don’t know the issue. How to fix it? This has not happened for any of our other services onboarded to same Haproxy cluster. Please someone can guide on this.

I would suggest to enable the unix admin socket and use show errors on it, this will show you more details about the last response that has been blocked, see:

9.3. Unix Socket commands and show errors in the docs.

Thanks for the reply!

I tried enabling the socket and print show errors by defining config in global section -

global
stats socket /tmp/haproxy-server.socket mode 600 level admin
stats timeout 2m

Where do we print show errors? on the host where we are deploying, will the logs be printed where other haproxy logs are printed or if not, at what path should I check?

On the local machine, issue:

echo "show errors" | socat /tmp/haproxy-server.socket stdio

[25/Feb/2025:11:43:45.443] backend name_backend (#22): invalid response
frontend name_Frontend (#4), server name (#4), event #2767, src 10.55.55.60:48914
buffer starts at 0 (including 0 out), 16377 free,
len 7, wraps at 16336, error at position 0
H1 connection flags 0x80002200, H1 stream flags 0x00004818
H1 msg state MSG_RPBEFORE(8), H1 msg flags 0x00001404
H1 chunk len 0 bytes, H1 body len 0 bytes :

00000 \x15\x03\x03\x00\x02\x02P

What is the error here?

The error is that this is random binary data, it does not even resemble a HTTP response.

You will have to tcpdump the traffic and analyze what happens here. Either the backend server randomly response with binary instead of HTTP or perhaps those are pipelined request with broken transaction delimitation.

See this as an example with a similar case:

We still could not figure out the way. Do we have any other similar example for this? Interesting part is we have other services of the same module which completely works fine but not this.

You need to capture the backend traffic, reproduce it and analyze the specific HTTP transaction that is failing.

Looking for other examples on the internet will not be helpful here.