F5 / Kong 500 error

techhadoop

Yes — F5 (BIG-IP or similar load balancer) in front of Kong can definitely contribute to or cause a 500 Internal Server Error, depending on how it’s configured.

✅ Scenarios Where F5 Can Cause 500 Errors in Kong

ScenarioExplanationHow It Leads to 500
Improper header rewritesF5 strips or rewrites headers like Host, Authorization, X-Forwarded-*Kong plugins (e.g., OIDC, JWT) fail internally
SSL offloading with missing SNIF5 terminates TLS and doesn’t forward proper SNI or client cert infoKong mTLS/auth plugins crash
Incorrect HTTP method handlingF5 mishandles certain HTTP methods (e.g., PATCH, OPTIONS)Kong routes fail or misroute
Request body corruptionF5 changes chunked encoding or breaks body formatKong/Lua fails to parse body
Timeouts/retriesF5 retry logic sends malformed or duplicate requestsKong misinterprets retries, triggers internal logic error

🔍 What You Can Check

  1. Preserve Headers:
    • Ensure F5 forwards: Host, Authorization, X-Forwarded-For, X-Forwarded-Proto, etc.
  2. SSL Passthrough or Proper Re-Termination:
    • If you terminate SSL at F5, ensure Kong receives expected headers (X-Forwarded-Proto=https, etc.)
    • If Kong expects client certs (mTLS), make sure F5 passes them correctly.
  3. Check Kong Logs:
    Look for header-related Lua errors or nil value dereferencing: attempt to index a nil value
  4. F5 Request Logs:
    Check the exact format F5 sends the request in (method, headers, body).
  5. Run curl directly to Kong (bypass F5): curl -v http://<Kong-IP>:8000/<your-path> If it works directly but fails via F5, then F5 is the culprit.

✅ Fixes and Tips

  • In F5:
    • Enable X-Forwarded-For, X-Forwarded-Proto, and Host headers.
    • Disable chunking if Kong or upstream doesn’t support it.
    • Avoid rewriting or stripping headers unless needed.
  • In Kong:
    • Enable trusted_ips and configure real_ip_header if you’re using X-Forwarded-For.

If you show me:

  • A sample request through F5 (e.g., with curl -v)
  • Any Kong plugin you’re using (OIDC, JWT, Rate Limiting, etc.)
  • A redacted error log line

…I can help pinpoint whether F5 is definitely the cause.

Leave a comment