Issue with CloudFlare response

Hi guys, I have a page where I can filter a list of results. the website is hosted on IIS. my query parameters are like so:
?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=10%2f03%2f2025&startDateMax=14%2f03%2f2025
?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=10%2f03%2f2025&startDateMax=14%2f03%2f2025
the issue is, if I search for any dates where startDateMax is less than the 14th of March, the response is correct. if I search anything from the date of 14th march or later on, without the other parameters changed, I get the error
Cloudflare encountered an error processing this request: Bad Gateway
Cloudflare encountered an error processing this request: Bad Gateway
with status 502. so the URL for the correct response would be this:
?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=10%2f03%2f2025&startDateMax=13%2f03%2f2025
?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=10%2f03%2f2025&startDateMax=13%2f03%2f2025
I believe this is an issue with CloudFlare because: I connecting with Remote Desktop to the server, accessed the same URLs from the website's local IP (bypassing CloudFlare) and the pages load correctly. I also see no errors in my IIS logs or Event Viewer. and if i check in CF > Analytics & Logs > HTTP Traffic and I find those calls, the Edge status codes are all
200 OK
200 OK
, same thing with the Origin Status code. any ideas? and thank you in advance
33 Replies
Laudian
Laudian5d ago
Can you share an example URL where we can reproduce the issue?
Rename
RenameOP5d ago
I'm afraid I can't unfortunately since that would be our client's page and needs credentials to access. I am unable to replicate that in other pages also if I check in Security > analytics for those calls I see 200 OK responses from both origin and edge
Edge response

Mitigation
Not mitigated

Cache status
Dynamic

Edge status code
200 - OK

Delivered Content type
html

Origin status code
200 - OK

Request analyses
Account abuse detection
Leaked credentials scan result
None

Content scanning
Uploaded content items scanned
0

Malicious?
No
Edge response

Mitigation
Not mitigated

Cache status
Dynamic

Edge status code
200 - OK

Delivered Content type
html

Origin status code
200 - OK

Request analyses
Account abuse detection
Leaked credentials scan result
None

Content scanning
Uploaded content items scanned
0

Malicious?
No
Laudian
Laudian5d ago
Could you share the full headers for both a successful and a failed request? Just remove any private info from the headers. I'm trying to replicate the issue, but it doesn't happen for me. Is this a free Cloudflare account or paid?
Rename
RenameOP5d ago
it's a free Cloudflare account. the error request has this data:
Request URL:
https://subdomain.domain.com/site/Example-Site/Gaming-Staff/manager-dashboard/occurrence-list?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=15%2f04%2f2025&startDateMax=26%2f04%2f2025
Request Method:GET
Status Code:502 Bad Gateway
Remote Address:104.26.0.102:443
Referrer Policy:strict-origin-when-cross-origin
Request URL:
https://subdomain.domain.com/site/Example-Site/Gaming-Staff/manager-dashboard/occurrence-list?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=15%2f04%2f2025&startDateMax=26%2f04%2f2025
Request Method:GET
Status Code:502 Bad Gateway
Remote Address:104.26.0.102:443
Referrer Policy:strict-origin-when-cross-origin
Response Headers:
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 930d1a444a63bc1a-SOF
content-length: 68
date:Tue, 15 Apr 2025 17:18:31 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT

proxy-status: Cloudflare-Proxy;error=http_protocol_error
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 930d1a444a63bc1a-SOF
content-length: 68
date:Tue, 15 Apr 2025 17:18:31 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT

proxy-status: Cloudflare-Proxy;error=http_protocol_error
referrer-policy: same-origin
=================================================== and this is the successful request data
Request URL:
https://subdomain.domain.com/site/Example-Site/Gaming-Staff/manager-dashboard/occurrence-list?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=15%2f04%2f2025&startDateMax=16%2f04%2f2025
Request Method:GET
Status Code:200 OK
Remote Address:104.26.0.102:443
Referrer Policy:strict-origin-when-cross-origin
Request URL:
https://subdomain.domain.com/site/Example-Site/Gaming-Staff/manager-dashboard/occurrence-list?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=15%2f04%2f2025&startDateMax=16%2f04%2f2025
Request Method:GET
Status Code:200 OK
Remote Address:104.26.0.102:443
Referrer Policy:strict-origin-when-cross-origin
Response Headers:
cache-control:no-cache, no-store

cf-cache-status:DYNAMIC
cf-ray:930d26269f0dbc1a-SOF
content-encoding:br
content-type:text/html; charset=utf-8
date:Tue, 15 Apr 2025 17:26:38 GMT
expires:-1
nel:{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma:no-cache
report-to:{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=12321413V5TgYLF1kJvkgIx5EFULpKWb9jVZ5Sl7J8drEO%2BhjN%2BQjRjsYenS6CnAQ7vC%2BPHJZsPEOitBHL8yold1ad1234HzkYS2uKAHKpqrsnVkyQmnWjtJ7ATfbZLX8FfDxmUxOsfFpD%2FXiTXw%3D%3D"}],"group":"cf-nel","max_age":604800}
server:cloudflare
server-timing:cfL4;desc="?proto=TCP&rtt=21709&min_rtt=20437&rtt_var=178&sent=479&recv=329&lost=0&retrans=0&sent_bytes=403674&recv_bytes=34071&delivery_rate=8393948&cwnd=396&unsent_bytes=0&cid=fc2d23d4045d5037&ts=507423&x=0"

x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
... (about 10 more times of the x-frame-options header)
cache-control:no-cache, no-store

cf-cache-status:DYNAMIC
cf-ray:930d26269f0dbc1a-SOF
content-encoding:br
content-type:text/html; charset=utf-8
date:Tue, 15 Apr 2025 17:26:38 GMT
expires:-1
nel:{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma:no-cache
report-to:{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=12321413V5TgYLF1kJvkgIx5EFULpKWb9jVZ5Sl7J8drEO%2BhjN%2BQjRjsYenS6CnAQ7vC%2BPHJZsPEOitBHL8yold1ad1234HzkYS2uKAHKpqrsnVkyQmnWjtJ7ATfbZLX8FfDxmUxOsfFpD%2FXiTXw%3D%3D"}],"group":"cf-nel","max_age":604800}
server:cloudflare
server-timing:cfL4;desc="?proto=TCP&rtt=21709&min_rtt=20437&rtt_var=178&sent=479&recv=329&lost=0&retrans=0&sent_bytes=403674&recv_bytes=34071&delivery_rate=8393948&cwnd=396&unsent_bytes=0&cid=fc2d23d4045d5037&ts=507423&x=0"

x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
x-frame-options:SAMEORIGIN
... (about 10 more times of the x-frame-options header)
I have no idea why x-from-options header is there multiple times, might have to check the response from the server directly, also is it possible to check somewhere in cloudflare the exact response from an HTTP request?
Laudian
Laudian5d ago
Can you check that the error isn't actually from your origin? curl -svo /dev/null https://sub.example.com/path?query --connect-to ::SERVER_IP Replace the domain/path/query and SERVER_IP
Rename
RenameOP5d ago
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< Date: Tue, 15 Apr 2025 18:09:42 GMT
< Content-Length: 1627987
<
{ [13529 bytes data]
* client returned ERROR on write of 13529 bytes
* closing connection #0
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< Date: Tue, 15 Apr 2025 18:09:42 GMT
< Content-Length: 1627987
<
{ [13529 bytes data]
* client returned ERROR on write of 13529 bytes
* closing connection #0
got this response running that so I guess the origin IS returning an error right? but why if I access that same request from within the server's browser, there's no issue and the page loads correctly
Laudian
Laudian5d ago
No, that looks all good. And that was with the query string that caused the error when requested via Cloudflare?
Rename
RenameOP5d ago
yes that's the one with the cloudflare error
Laudian
Laudian5d ago
Oh, I just noticed the end "client returned ERROR on write of 13529 bytes" That does not look good. Does the same happen if you use a "good" query string?
Rename
RenameOP5d ago
yes actually same error with a "good" query string:
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< Date: Tue, 15 Apr 2025 18:23:55 GMT
< Content-Length: 1095994
<
{ [31508 bytes data]
* client returned ERROR on write of 16384 bytes
* closing connection #0
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< Date: Tue, 15 Apr 2025 18:23:55 GMT
< Content-Length: 1095994
<
{ [31508 bytes data]
* client returned ERROR on write of 16384 bytes
* closing connection #0
not sure if it's worth mentioning, I copied the curl from the browser because I also needed the cookies since I need to be authenticated for that request. I also had to add -k flag for self-signed certificates
Laudian
Laudian5d ago
Are you piping the curl output somewhere instead of using -o /dev/null ?
Rename
RenameOP4d ago
I gave it a try with an output to a .txt file for both the successful request and the error one. both request filled the text files with the appropriate HTML codes and no errors were there i guess the error before was because /dev/null was not a correct output directory
Laudian
Laudian4d ago
Hmm, sry for the late reply. I'm really out of ideas then. Did the issue only start recently?
asuffield
asuffield3d ago
can you give the actual url? either here, or put it in a support ticket and post the ticket number here. I can glance at the logs for clues, no guarantee I'll find anything though this just sounds weird and I don't have any guesses
Rename
RenameOP3d ago
yep it's only started recently. it actually happened maybe about 2 weeks ago or more, then it resolved on it's own and now it's back again. seems I can't create a support ticket with my account so this is the actual URL (with error:
Cloudflare encountered an error processing this request: Bad Gateway
Cloudflare encountered an error processing this request: Bad Gateway
) tested just now: https://hippodromecasino.smartrota.com/site/The-Hippodrome-Casino-Ltd/Gaming-Staff/manager-dashboard/occurrence-list?contractOption=All&occurrenceRule=&occurrenceType=&selectedName=&startDate=15%2f04%2f2025&startDateMax=30%2f04%2f2025 you won't be able to access the page since it'll redirect to the login, but if there's anything other info I could give let me know. appreciate both your guys help
asuffield
asuffield3d ago
I don't have any logs captured for 502s on that zone. must not happen often enough, we don't store every request
Rename
RenameOP3d ago
I could retry right now if you're free to look just gave it a go again right now, with the same url
asuffield
asuffield3d ago
the chance of catching a log line is low, let me get a trace token for you okay, add this header to the request (good for a single use, and expires very quickly):
Cf-Trace-Id: xxx
Cf-Trace-Id: xxx
Rename
RenameOP3d ago
made a request with that header included just now
asuffield
asuffield3d ago
didn't catch it, must have been too late. let me make you a new id try with that one they really don't last long
Rename
RenameOP3d ago
done
asuffield
asuffield3d ago
got it this time. okay, let's see what happened
Rename
RenameOP3d ago
perfect let me know if I can be of any help
asuffield
asuffield3d ago
wow okay, did not see that one coming. connection reset by peer the origin is either closing the connection or crashing or something, when presented with this query I hope this is somehow helpful - it's definitely not on our end we got a whole chunk of response sent, and then it died
Rename
RenameOP3d ago
huh strange one for sure, I'll see if I can find something out thank you again so you got a partial response then it just ended?
asuffield
asuffield3d ago
it did something for about a second, sent us about 82kb of data, and then the connection died without finishing the response that's a weird enough failure mode that it must have eluded our usual "report the error to the customer" logging pipeline
Rename
RenameOP3d ago
really weird one for sure, considering I don't get any errors or info in Event Viewer, IIS logs or even Sys32/HTTPErr files of the server but this also wouldn't explain why it doesn't fail if I access it directly from the server IP right? or is there an explanation for that I'm missing
asuffield
asuffield3d ago
yeah beats me. must be something different about the request received through the CDN connection reset is a weird failure mode so it could also be something at the network level. all we really know is that we received a RST packet for this socket
Rename
RenameOP3d ago
I'll likely have to compare the requests with Wireshark to see if I can find a difference between the CF forwarded one and the one being sent directly
Laudian
Laudian3d ago
Just another quick question: Could you check which http versions Cloudflare and direct visitors used to connect to the server?
Rename
RenameOP2d ago
they all are HTTP/2 version
Rename
RenameOP2d ago
I was able to get the logs, I guess it was taking some time for them to show up and this is the data I got now, notice the 995 sc-win32-status code of the last request the second and third (last) requests both failed when going through CF with the Bad Gateway error but seems only the third one returned the 995 code which translates to
995 (0x3E3)

The I/O operation has been aborted because of either a thread exit or an application request.
995 (0x3E3)

The I/O operation has been aborted because of either a thread exit or an application request.
the website's timeout limit was 120 seconds, even changed it to 300 but got 995 again when time-taken is 10565(ms)
Rename
RenameOP2d ago
I'm also not sure the headers from the cloudflare request are quite right (Connection close): I've removed some uneccessary ones
Cache-Control: max-age=0
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: ...
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
sec-fetch-dest: document
cf-ipcontinent: EU
x-forwarded-proto: https
cdn-loop: cloudflare; loops=1
cf-visitor: {&quot;scheme&quot;:&quot;https&quot;}
priority: u=0, i
upgrade-insecure-requests: 1
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
Cache-Control: max-age=0
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: ...
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
sec-fetch-dest: document
cf-ipcontinent: EU
x-forwarded-proto: https
cdn-loop: cloudflare; loops=1
cf-visitor: {&quot;scheme&quot;:&quot;https&quot;}
priority: u=0, i
upgrade-insecure-requests: 1
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1

Did you find this page helpful?