The 499 status code may be returned when using Request timeouts and Exception Handler together

[marcominerva]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Depending of the order of the middlewares, when a request timeout occurs, a 499 status code (instead of 504) may be returned:

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddRequestTimeouts();

var app = builder.Build();

// If I put the RequestTimeoutsMiddleware here (before Exception Handler), I get a 499 error when a Timeout occurs.
app.UseRequestTimeouts();

app.UseExceptionHandler();

// If I put the RequestTimeoutsMiddleware here (after Exception Handler), I get (as expected) a 504 error when a Timeout occurs.
//app.UseRequestTimeouts();

I think this is caused by this code in the Exception Handler Middleware: https://github.com/dotnet/aspnetcore/blob/main/src/Middleware/Diagnostics/src/ExceptionHandler/ExceptionHandlerMiddlewareImpl.cs#L117-L128

Expected Behavior

When a request timeout occurs, I expected to always get the 504 error (or the one that has been configured in the policy).

Steps To Reproduce

Minimal repro here: https://github.com/marcominerva/TimeoutIssue

Exceptions (if any)

No response

.NET Version

8.0.100

Anything else?

No response

[Kahbazi]

I looked at this issue briefly, perhaps a fix for this is to call HttpResponse.StartAsync in timeout middleware after the status code is set and a response has been written. Any thoughts @Tratcher?

aspnetcore/src/Http/Http/src/Timeouts/RequestTimeoutsMiddleware.cs

Lines 122 to 127 in 9355649

	context.Response.StatusCode = selectedPolicy?.TimeoutStatusCode ?? StatusCodes.Status504GatewayTimeout;
	if (selectedPolicy?.WriteTimeoutResponse is not null)
	{
	await selectedPolicy.WriteTimeoutResponse(context);
	}

[Tratcher]

This is an interesting scenario, but everything here is working as expected. Middleware are order sensitive, and in the case of an exception, the last one gets the first chance to handle it. The Exception Handler should always come at the start of the pipeline regardless.

Action: I'll add a note in the docs about the recommended order.
https://learn.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-8.0#built-in-middleware

I looked at this issue briefly, perhaps a fix for this is to call HttpResponse.StartAsync in timeout middleware after the status code is set and a response has been written. Any thoughts @Tratcher?

That's not going to help. The exception handler won't rethrow the exception, so the timeout middleware can't handle it if it's placed first.