Disconnects During POST (File Upload) - Started May 2, 2024

On May 2, 2024, we began having intermittent issues where our reverse proxy, NGINX, sitting behind CF on a fully encrypted SSL connection started reporting that the client (CF) had disconnected during the POST (upload) of a file (“client prematurely closed connection”). This error occurs exactly 15 seconds after the initial connection and NGINX logs a 400 error for the status code. There is no pattern to the disconnects. I’m testing with a static set of 100 files, and the issue occurs randomly and approximately once every 150 uploads. If I bypass Cloudflare, and have the browser connect directly to NGINX, the issue does NOT occur. I’ve tried swapping NGINX for HA Proxy and Yarp, and the issue still occurs when Cloudflare is proxying the requests. It seems to be an issue with Cloudflare, and not an issue with the browser, application server, or reverse proxy since the only occurs when CF is proxying requests. I’ve tried disabling all DDOS and bot protections in the CF control panel, and the problem persists.

Here is the log showing the issue. Notice the requests are coming from CF IPs, and are the same request repeatedly (unique cb=1717729895463). CF is the one that is retrying these request repeatedly and not the client (dev tools on the browser shows only 1 request and the requests continue even if the browser is closed).

Is anyone else experiencing this issue and did it start recently?

#date time c-ip cs-username s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status time-taken
2024-06-07 03:11:38 162.158.154.x - server1 xxx.xxx.xxx.xxx 443 POST Image2 cb=1717729895463 400 15035.8573
2024-06-07 03:12:39 172.70.110.x - server1 xxx.xxx.xxx.xxx 443 POST Image2 cb=1717729895463 400 15011.1611
2024-06-07 03:13:09 162.158.158.x - server1 xxx.xxx.xxx.xxx 443 POST Image2 cb=1717729895463 400 15001.9008