Free tools Windows power users keep installed
One-click scans. No signup required.
In a reverse proxy, failures can hinge on which side caused them: the client or the upstream, the inbound protocol or the upstream protocol, the selected route or its fallback. Bipin C’s account of ferryman-edge, a Rust layer-7 proxy, describes five bugs where those boundaries mattered. The fixes are useful implementation lessons, not evidence that these problems are unique to Rust or occur in every proxy.
What ferryman-edge does
Bipin C describes ferryman-edge as a small layer-7 reverse proxy written in Rust. In the author’s account, a request passes through mutual TLS authentication, RS256 bearer-token verification, per-tenant GCRA rate limiting, and an upstream circuit breaker with active health checks. Certificates and routes can be hot-reloaded on SIGUSR1: existing connections retain the TLS configuration used during their handshake, while new connections use the reloaded configuration.
The author says reusable components were published as ferryman-edge-core: a reloading TLS configuration, cached JWT verifier, per-tenant limiter, and routing table with its breaker. The article gives cargo install ferryman-edge as the installation command. Current package availability and versions are not established here. Read Bipin C’s account on DEV Community.
1. An HTTP/2 request reached a plain HTTP upstream
The proxy listener advertised HTTP/2 and HTTP/1.1 through ALPN, while the upstream used plain http://. According to the author, the proxy carried the inbound request’s HTTP/2 version into the upstream request. Hyper-util’s legacy client then rejected an HTTP/2-versioned request on an HTTP/1 connection with UserUnsupportedVersion; the proxy returned a 502.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The fix was to treat the two connections as separate protocol legs: reset the forwarded request version to HTTP/1.1 for the plain HTTP upstream. The response needed normalization too. A Python http.server upstream could answer with HTTP/1.0, which otherwise risked returning an HTTP/1.0 status line to a keep-alive HTTP/1.1 client. The author says an end-to-end test exercises a real HTTP/2 request.
2. An open breaker changed which route handled a request
Routes use longest-prefix matching on path-segment boundaries. The original lookup combined route matching with a check that the upstream was routable. When the most-specific route matched but its breaker was open, the lookup could continue and select a broader route instead. In the author’s example, /svc-a/x fell through to the catch-all / route.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
That is not merely an availability fallback: it changes the identity of the service receiving the request. The fix separates the decisions. First select the most-specific matching route; then check whether that route’s upstream is routable. If it is not, return 503 rather than silently forwarding the request to a less-specific backend.
3. Multiple requests could become half-open recovery probes
After a breaker’s cooldown, a half-open breaker should admit only one request to test whether the upstream has recovered. The author reports that a compare-and-swap based on the breaker state byte could admit multiple probes through an ABA window. The shipped approach uses the last-transition timestamp as the compare-and-swap token instead.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
The account also identifies a zero-second cooldown edge case: callers in the same second could all appear eligible. The implementation now rejects a zero cooldown. To test probe admission, the author says eight threads were released behind a barrier, the test was repeated 200 times, and exactly one request was admitted on each run. Those are the author’s reported test conditions and result, not an independently reproduced benchmark.
4. A client upload failure could trip a shared upstream breaker
With streaming request bodies, reading the body is part of the upstream call. The author says a client disconnect or body length-limit error could therefore be counted as an upstream failure. Because the breaker is shared by a route, one authenticated tenant could affect other tenants using that route.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The fix was to classify failures by origin. The proxy walks the error source chain to identify client-body errors, including the configured length-limit error and Hyper user errors, rather than treating them as upstream failures. The author also describes separate deadlines: reading the client body gets its own deadline and a 408 response, while the upstream timeout starts once the body is available. A wrapper records stream completion where needed. Reading the body before route lookup also prevents a client-side failure from consuming a half-open recovery probe.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Hop-by-hop header stripping removed the trusted tenant header
After verifying a JWT, the proxy adds x-ferryman-tenant using the token subject, first removing any client-supplied value. It also strips hop-by-hop headers and headers named by Connection. In the faulty order, stripping happened after the proxy added its trusted tenant header. A client could send Connection: keep-alive, x-ferryman-tenant, causing the proxy to strip the header it had just stamped.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The correction is to strip hop-by-hop and connection-nominated headers first, then add the trusted tenant identity. The author says a regression test exercises the case over HTTP/1.1; HTTP/2 forbids the Connection header.
Other implementation issues the author reported
The same account mentions additional project-specific fixes. A Tokio select! guard was checked when selection began rather than when the timer branch fired, so the relevant flag was moved into the branch check. The author also says jsonwebtoken 9 checks issuer and audience only when those claims are present; requiring an issuer therefore also requires required_spec_claims to include iss.
Other reported deployment observations include Linux process-name truncation affecting pgrep -x, a glibc mismatch between a trixie builder and bookworm runtime, and pinning the builder to bookworm. These describe the author’s environment and project decisions, not universal behavior guarantees for those tools or platforms.
What the reported figures do—and do not—show
Bipin C’s article is labeled as posted on September 29 and “last year” in search metadata; the date is interpreted here as September 29, 2025, but the page could not be directly confirmed. The author’s figures below are reported results, not independently reproduced measurements.
| Reported result | Conditions and qualification |
|---|---|
| 3,725 of 3,725 requests succeeded | Author-reported 60-second hot-reload run using a release build, eight curl workers, and two SIGUSR1 signals. Each request used a fresh curl process to exercise a new mutual TLS handshake. |
| 0.68 µs cache-hit JWT verification; about 150 µs cache-miss verification | Author-reported Criterion measurements. |
| 16 MB RSS | Author-reported memory use after the hot-reload run above. |
| 119 ms TLS handshake p99 | Author-reported; the author cautions that the client and server shared one machine, so this is not representative. |
| 50,000 requests per second target | Not measured. The available wrk/wrk2 setup could not present a client certificate, and the author said an mTLS-capable load generator was still needed. |
The boundary lesson behind the five fixes
These incidents share a practical rule: preserve attribution and identity across each proxy boundary. Normalize protocol versions for the upstream leg rather than assuming it speaks the client’s protocol; choose the winning route before checking breaker availability; ensure only one recovery probe can pass; keep client upload failures from poisoning upstream health; and sanitize connection-controlled headers before adding trusted identity. Those are lessons from this implementation’s reported bugs, not a claim that they occur only in reverse proxies or only in Rust.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
