From: Willy Tarreau <w@1wt.eu>
Date: Wed, 30 Sep 2026 09:03:34 +0000 (+0200)
Subject: BUG/MINOR: http-ana: return a 502 when checkcache blocks a response
X-Git-Tag: v3.5-dev8~83
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=9802e33a3f8555f3a6e84eed71cb43e28204b978;p=haproxy.git

BUG/MINOR: http-ana: return a 502 when checkcache blocks a response

The documentation of "option checkcache" states that a response which
does not respect its requirements "will be blocked just as if it was
from an http-response deny rule, with an HTTP 502 bad gateway".

The code jumps to the "deny" label without touching txn->status, which
at that point still holds the status the server had returned. The
response delivered to the client is thus a 200 (or anything else that
the server returned), and the error files are not even used in this
case. Let's just properly set the status to 502 just like the other
rules such as "http-response deny" do. It now does what the doc says.

This has been there forever so it can be backported to all stable
branches.
---

diff --git a/src/http_ana.c b/src/http_ana.c
index c3f5786f6..bf2482178 100644
--- a/src/http_ana.c
+++ b/src/http_ana.c
@@ -1996,6 +1996,7 @@ int http_process_res_common(struct stream *s, struct channel *rep, int an_bit, s
 		send_log(s->be, LOG_ALERT,
 			 "Blocking cacheable cookie in response from instance %s, server %s.\n",
 			 s->be->id, objt_server(s->target) ? __objt_server(s->target)->id : "<dispatch>");
+		txn->status = 502;
 		goto deny;
 	}