502 Bad Gateway and 504 Gateway Timeout Through a Proxy: Who Failed, and How to Tell

Which gateway answered?

For HTTPS targets the distinction is especially clean. The proxy can only speak to you before the tunnel is up; once TLS is established, everything you receive comes from the website side. A 502 in the CONNECT response is the proxy. A 502 inside the page is not.

curl -v -x http://USERNAME:PASSWORD@PROXY_HOST:PROXY_PORT https://example.com -o /dev/null 2>&1 | grep -E "^< HTTP|cf-ray|server:"

502 Bad Gateway from the proxy

• The exit could not reach the site. Residential exits are real devices that go offline; retry with a new session tag.
• DNS failed at the exit. Rare, but it shows up as a 502 for one hostname only.
• The site refused the exit's network at the TCP level. Try a different country or ASN.
• The target port is not allowed by the proxy. Most proxies tunnel 80 and 443; exotic ports may be refused.

504 Gateway Timeout

Someone in the chain gave up waiting. That can be the proxy timing out on a slow target, a CDN timing out on a slow origin, or the origin's own load balancer timing out on its application. The fixes, in order of how often they work:

1. 1Reduce concurrency. Too many parallel requests to one host slow every response down past the timeout.
2. 2Raise your client timeout if the page is genuinely slow — heavy search pages and report exports can take 30 seconds or more.
3. 3Retry with backoff. A transient 504 usually clears on the second attempt after a pause.
4. 4Pick a closer exit. A US target through an Asian exit adds latency to every round trip.

502 and 504 from Cloudflare

Cloudflare uses its own 52x range to be more specific: 520 for an unknown origin error, 521 when the origin refused the connection, 522 when it timed out, 524 when the origin took too long to respond. All of them are on the site's side, and no proxy change will fix them. A plain 502 or 504 with a cf-ray header means Cloudflare itself struggled to reach the origin.

Handling them in code

RETRY_ON_NEW_EXIT = {502, 503}
RETRY_SAME_EXIT = {504}

for attempt in range(3):
    r = session.get(url, timeout=45)
    if r.status_code in RETRY_ON_NEW_EXIT:
        session = new_sticky_session()
    elif r.status_code in RETRY_SAME_EXIT:
        time.sleep(2 ** attempt * 5)
    else:
        break

The rest of the status codes you will meet through a proxy are in proxy error codes explained, and cURL's own exit codes in cURL proxy errors.