We are getting frequent alert of HTTP success rate being low, when looking into the possible reasons today, we have discovered some possible causes.

Some requests performed by penetration testing return 500 while it is actually an invalid input. This triggers our success rate HTTP alert every day. Let’s fix this as part of one patch.

To get a full list of these requests see Kibana.

•  /api/provisioning/v1/sources/{ID}/launch_templates returns 500 when ID is invalid (sources return 404)
• /api/provisioning/v1/sources/zj{{=9243*9806}}zj/launch_templates returns 500 when ID is not a valid integer (sources return 400)
• /api/provisioning/v1/pubkeys - validation model error returns 500

In general:

• When an ID is not an integer, we should fail early with 4xx.
• When a backend service returns 4xx we should error with the same HTTP code.
• Model validations (e.g. in pubkey) should error with 4xx not 5xx.