502.3 Error Code 2147954552 Reverse Proxy Cookie problem

Hi @Dawid Kotynia ,

Are you just using ARR as a reverse proxy, or as a load balancer to route requests to multiple backend servers? If it is a reverse proxy, are there multiple servers? What is their structure like?

In fact failed request tracing is the most useful log, it can record the root cause of the problem. You can also check the event viewer for error messages. Please post both logs if possible.

As far as I know, cookies are stored on the client side, and 502.3 indicates a problem with server-side requests, cookies do not affect ARR. So your problem is most likely that the request with the cookie is not being forwarded to the correct server by ARR. Maybe the cookie generated by server A is sent to the client, and the session corresponding to the server is only stored in server A. But the next request is forwarded to server B. Session authentication failure resulted in a timeout.

Hi,

Thank you for response. ARR is a reverse proxy right now. I have only one application server - backend server at this point. I fully understand that 502.3 shall be not related to cookie, but I described what I observe, and this problem could be easily reproduced. The example ARR log here
The IIS respond imidiately so it is not timeout issue. The client request is not farworded to application server at all, is handled by IIS and IIS respond imidiately with 502.3. When cookie is not on a client side, the request is properly forwarded to application server. I found a workaround solution by removing the cookie from client by server doing Set-Cookie with Max-Age=-1. The problem accours when client have old cookie stored, from previous session or not valid anymore. In my opinion it shall be still farworded to aplication server so server can decide what to do and not the IIS which shall only farword the requests. Maybe the problem is here in my understanding, but the problem shows when the Chrome and Edge version 98 has been released. Old versions did not behave like that.
When the client will close the session by closing the browser the session cookie shall be removed by browser anyway, so then no problem. Only when cookie with expired session key is in the browser memory.

The problem still exist I'm afraid it will surely show up, when it will be very critical. I would like to understand what is happening, why IIS do not forward request to backend server.