504 Gateway Timeout on /tpa/api/consent and /tpa/api/consent/validateUser
Is anyone else seeing 504s on the consent endpoints today?
On Friday 4 September, between roughly 07:53 and 08:40 AEST, we could not complete a granular-scope authorisation. Both of these returned HTTP 504 Gateway Timeout:
POST https://secure.myob.com/tpa/api/consent
POST https://secure.myob.com/tpa/api/consent/validateUser
The consent screen renders correctly with the expected scope groups. It fails when the business file is selected (validateUser) and again on Connect (consent). The only user-facing message is "Something went wrong and we couldn't connect the app. Try again later."
The response headers show the 504 is coming from CloudFront rather than the application:
via: 1.1 ...cloudfront.net (CloudFront)
x-amz-cf-pop: SYD3-P2
x-cache: Error from cloudfront
Time waiting for server response: 30.02 seconds
30.02 seconds is CloudFront's default origin response timeout, so it looks like the origin is not responding rather than anything being rejected.
Things I have already ruled out. It reproduces outside our application entirely, by pasting the authorisation URL into a clean browser session with no client software involved. It reproduces with two different registered redirect URIs, so it is not redirect configuration. It is not our firewall — 31 other requests on the same page, same host, same TLS session, all succeeded. On one attempt validateUser did succeed, but took 14.12 seconds, which suggests the service is very slow rather than rejecting anything.
Two questions:
Is anyone else hitting 504s on these endpoints, today or recently?
If you have seen this before, did it clear on its own, and roughly how long did it take?
Existing integrations using a stored refresh token are unaffected, since the refresh grant does not touch these endpoints. This only bites on a fresh authorisation — which may be why it is not more visible.
