Investigate 502 across three boundaries, before restarting everything
Separate client, proxy and upstream faults using time and request identifiers, with a short investigation path that avoids premature conclusions.
Technical source: MDN’s definition of 502 Bad Gateway. The sequence below is an independent proposal.
A 502 usually indicates that a gateway or proxy received an invalid upstream response. It does not identify a broken database or justify restarting every server by itself.
Three boundaries, three questions
- Client to gateway: Which hostname, path and time are affected? Does it recur across connections?
- Gateway to application: Do destination, port, hostname and connection method match the approved configuration? What did the proxy record then?
- Application and dependencies: Did the request arrive, and where did it fail or stop?
A common identifier and timestamp connect the findings. An old log message is not automatically the cause of today’s request.
A hypothetical example
After deployment, the proxy’s destination port differs from the application’s port. The application is healthy but routing is wrong. Restarting the database targets neither cause and may add disruption.
Completion criteria
Retest the same user path while observing proxy and application responses. An open port or a different working page is insufficient. If changing configuration, change one factor and record outcome and rollback.
Related reading: what to record before restarting.
Source checked: November 2, 2026. The example is hypothetical; a status code does not replace evidence and product-specific configuration checks.
Continue reading
All posts →
The ownerless service account: a small access path easily forgotten
Give each service account a short card: purpose, owner, permissions, secure credential reference and review date, without putting passwords in public documents.
Not ready or actually stuck? One health check cannot make every decision
Separate readiness for traffic from application liveness so a temporary dependency fault does not become a restart loop.
TLS renewed, but users still see an error: what to check
Renewal success is not the finish line. Check hostname, served certificate and CDN-to-origin connection separately without bypassing browser warnings.