Uploads fail under bulk load with 524 timeouts and misleading CORS errors

[ryanmcdonough]

Summary

Uploading multiple large files consistently fails in production. What shows up in the browser looks like a CORS issue, but it’s actually timeouts under load.

That makes it harder to debug and breaks a normal workflow, uploading a batch of documents.

---

Environment

Frontend: https://app.mikeoss.com
API: https://api.mikeoss.com

Endpoints:

• POST /single-documents
• POST /projects/:projectId/documents

---

Reproduction

1. Log into the app
2. Upload ~20 files at ~40MB each
3. Observe network tab and console

---

Actual Behaviour

• Requests fail with status 524
• Browser reports:
  • "Origin not allowed by Access-Control-Allow-Origin"
  • "Fetch API cannot load…"
  • "TypeError: Load failed"
• Failures occur across both upload paths
• Frontend retries appear to amplify load

---

Expected Behaviour

• Uploads either succeed within supported limits
• Or fail cleanly with explicit responses (e.g. 413, 429, 503)
• All responses include valid CORS headers
• UI shows clear per-file outcomes

---

What’s Actually Happening

This is not a CORS issue. It’s timeout behaviour surfacing as CORS because the response does not complete properly.

Under load:

• Requests exceed execution window → Cloudflare returns 524
• Error responses bypass normal middleware
• CORS headers are missing → browser reports access control failure

---

Likely Causes

Synchronous processing in request path
Upload → parse → extract → respond in a single request does not scale under concurrency

Unbounded parallel uploads
Client sends multiple large files simultaneously without effective throttling

Memory pressure from request handling
Every JSON endpoint shares:

express.json({ limit: "50mb" })

[ryanmcdonough]

I mainly focus on backend/API testing, auth/session validation, edge-case behavior, and release-stage reliability checks. I usually help identify reproducible issues around API behavior, session handling, deployment regressions, and failure scenarios before release.

Okay?

[amal66]

Thanks for the detailed diagnosis — it held up well against the code. Status of each cause you identified, and what fixes it:

1. Synchronous processing in the request path (the 524 driver) → #294. Office→PDF conversion (and legacy-format text extraction) move off the request thread onto a durable job queue — BullMQ when Redis is configured, a Postgres FOR UPDATE SKIP LOCKED queue otherwise. Upload requests store the file, mark the rendition pending, and return immediately, so nothing in the upload path can approach Cloudflare's timeout window anymore. One rollout caveat: fresh docker-compose installs get this by default, but an existing deployment (including production) must opt in after upgrading — ASYNC_DOCUMENT_CONVERSION=true plus either REDIS_URL or QUEUE_DRIVER=postgres.

2. Unbounded parallel uploads from the client / no per-file outcomes → #381 (+ #380, already merged). #380 introduced a bounded-concurrency upload pool (2 in flight) for the documents-table directory upload; #381 ports the same mechanism to the three remaining multi-file upload surfaces (project chat explorer, New Tabular Review, Add Documents). One failed file no longer discards the batch — successes land in the UI and the failed files are named in a dismissible warning. No auto-retry was added, deliberately, per your note about retries amplifying load.

3. Missing CORS on error responses / non-explicit errors / express.json memory pressure → already fixed on main since this was filed: the CORS middleware runs before the rate limiters and routes, uploads are multipart (multer, 100MB cap → clean JSON 413; they don't pass through express.json), upload endpoints are rate-limited (JSON 429), and a final error boundary converts body-parser and unhandled errors into sanitized JSON responses with request IDs. The 524s Cloudflare itself generates can never carry CORS headers — that part is only fixable by #294 making the responses fast.

Suggest keeping this open until #294 and #381 merge and the production flags are flipped.