Skip to content

Add exponential backoff retry for SSC 502/503 errors addressing temporary server errors without stopping fcli#936

Open
gilseara wants to merge 2 commits intofortify:dev/v3.xfrom
gilseara:feature/ssc-retry-502-503
Open

Add exponential backoff retry for SSC 502/503 errors addressing temporary server errors without stopping fcli#936
gilseara wants to merge 2 commits intofortify:dev/v3.xfrom
gilseara:feature/ssc-retry-502-503

Conversation

@gilseara
Copy link
Copy Markdown
Contributor

@gilseara gilseara commented Mar 3, 2026

Add SSCRetryStrategy implementing Apache HttpClient's ServiceUnavailableRetryStrategy to retry on HTTP 502 (Bad Gateway) and 503 (Service Unavailable) with exponential backoff (1s, 2s, 4s) and random jitter (0-500ms). Wire it into the SSC unirest instance via a custom ApacheClient, following the existing FoD retry pattern.

Add SSCRetryStrategy implementing Apache HttpClient's
ServiceUnavailableRetryStrategy to retry on HTTP 502 (Bad Gateway)
and 503 (Service Unavailable) with exponential backoff (1s, 2s, 4s)
and random jitter (0-500ms). Wire it into the SSC unirest instance
via a custom ApacheClient, following the existing FoD retry pattern.
Copy link
Copy Markdown
Contributor

@rsenden rsenden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two questions:

  • Is there any risk of POST/PUT/DELETE operations being repeated, causing for example two new entities to be created in SSC rather than just one? Possibly safer to only retry GET requests?
  • Should we apply the same retry strategy to SC-SAST/SC-DAST, and maybe also replicate to FoD?

@gilseara gilseara force-pushed the feature/ssc-retry-502-503 branch 2 times, most recently from feb0c1b to d0b5dbc Compare March 24, 2026 12:35
Only retry GET requests on 502/503 to avoid duplicate side effects from
retrying non-idempotent operations. Apply the same retry strategy to
SC-SAST and SC-DAST unirest instances, and add 502/503 GET-only retry
to FoDRetryStrategy alongside the existing 404/429 handling.
@gilseara
Copy link
Copy Markdown
Contributor Author

@rsenden
Agreed, limited 502/503 retry to GET requests; apply to SC-SAST, SC-DAST, and FoD
Only retry GET requests on 502/503 to avoid duplicate side effects from
retrying non-idempotent operations.
Applied the same retry strategy to SC-SAST and SC-DAST , and added 502/503 GET-only retry
to FoDRetryStrategy alongside the existing 404/429 handling.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants