[Bug] Gateway timeout on 401

[simonhir]

Bug description

If the gateway receives an 401 from the backend the request between client and gateway is loading indefinitely.

Expected behaviour

The 401 is passed through from backend to client.

Steps for reproduction

1. modify backend to always return 401 (aud claim or different keycloak hostname between gateway and backend)
2. Make call to gateway -> logs schows 401 from backend to gateway, but response between client and gateway is still loading

Affected version

1.6.0

Affected component

refarch-gateway

Last working version (optional)

Perhaps before Spring Boot 3.5.

Operating system

No response

Browser

No response

Relevant log output (optional)

Screenshots (optional)

No response

Additional context (optional)

No response

No duplicate

• I confirm that this issue is not a duplicate

Code of Conduct

• I agree to follow this project's Code of Conduct

[simonhir]

@FabianWilms could you please provide the image version you used, where the error also occurred?
We again had the same problem with an local test, with the newest version.

[devtobi]

I systematically tested with the following image versions:

• 1.5.0 -> still timeout
• 1.4.5 -> still timeout
• 1.4.4 -> still timeout
• 1.4.3 -> still timeout
• 1.4.2 -> still timeout
• 1.4.1 -> still timeout
• 1.4.0 -> still timeout
• 1.3.1 -> still timeout
• 1.2.0 -> didn't run locally
• 1.1.2 -> still timeout
• 1.1.1 -> still timeout
• 1.0.0 -> still timeout

So I am (more or less) happy to say the problem:

• either still existed and we never noticed
• the problem does not originate from the gateway

[devtobi]

I tested a different occasion of the 401 status code:
When the backend and gateway is pointing to the same keycloak URL and the user has no permission for a given endpoint, the request is properly handled with a 401 status code.
This happens instantly and does not result in a timeout.

=> The issue should be occuring from the backend when the keycloak URL is incorrectly configured.

[simonhir]

The error also occurs if the aud claim doesn't match. So it seams the problem occurs if the Token itself can't be validated.

What also should be precluded is if the problem comes from one of our custom filters.

[devtobi]

The error also occurs if the aud claim doesn't match. So it seams the problem occurs if the Token itself can't be validated.

What also should be precluded is if the problem comes from one of our custom filters.

I tested this with all our custom filters disabled (in the backend) and the problem still occurs.

However I'm starting to think whether its a real-case-scenario problem as mismatching aud claims or wrongly configured SSO urls are definitely a configuration issue.