Identity (gotrue) /token returns 502 Bad Gateway intermittently to my clients only — healthy from server-side probes

Support
1

Site: unlikely-app (custom domains app.unlikelyproject.org + unlikelyproject.org) Site ID: (fill in if asked — find it at Netlify → Site information) Symptom severity: Members can’t log in via the bundled netlify-identity-widget. The widget renders “User not found” because gotrue 502s before the request reaches it. Bypassing the widget by POSTing directly to /token reproduces the 502 from affected browsers and networks.

What’s happening

POST /.netlify/identity/token (grant_type=password) returns 502 Bad Gateway to my browser clients on multiple networks (home WiFi, mobile data, different ISPs in Cincinnati, OH).

The same POST returns 200 with a valid JWT when executed:

  • From a Netlify Function on the same site (server-side fetch)
  • From a sandboxed Linux environment in a different region

So the user exists, the password is correct, the gotrue instance is healthy on the server side — but my clients hit a 502 at the edge.

Reproduction

Browser DevTools console on app.unlikelyproject.org:

js

fetch('/.netlify/identity/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: 'grant_type=password&username=grant%40unlikelyproject.org&password=<valid-password>'
}).then(r => console.log('client status:', r.status))

Result from my browser: client status: 502

Same POST from a Netlify Function I deployed on the same site (different network path):

js

const r = await fetch(`${context.clientContext.identity.url}/token`, { ... });
// r.status === 200
// r.json() returns a valid access_token + refresh_token

Other observations

  • GET /.netlify/identity/settings → 200 (healthy)
  • GET /.netlify/identity/health → 200 (healthy)
  • It’s specifically the /token endpoint that 502s for my clients
  • The 502 response body is the Google Frontend (GFE) default 502 HTML, not a gotrue response. So this looks like an edge routing / load balancer issue between Netlify’s CDN and the gotrue instance, geographic to me.
  • Reset-password emails arrive correctly. The #recovery_token=... in the email link reaches my browser intact, but the widget’s subsequent verify call (also hits gotrue) fails similarly.

What I’d like Netlify to investigate

  1. Why the /token endpoint specifically returns 502 to clients in certain geographies/IPs while the server-side gotrue instance is healthy.
  2. Whether there’s an edge cache or LB rule that needs to be cycled for this site.
  3. Any logs on your side correlating my client IP / x-nf-request-id to gotrue-side 502s.

I can provide a request ID from the next 502 if helpful — x-nf-request-id from the failing response will be in the DevTools Network panel.

Thanks — this is blocking real users from logging in.