Nginx Proxy Issue: In production, TUS resumable upload initialization succeeds, but chunk upload fails.

[horner]

Summary

In production, TUS resumable upload initialization succeeds, but chunk upload fails.
POST /uploads returns 201, then PATCH /uploads/:id returns 405 Not Allowed.

This breaks PulseCam chunked uploads and surfaces an upload failure alert in the UI.

Affected Environment

• Environment: production (nginx proxy in front of Node/Express)
• URL: https://pulseclip.os.mieweb.org/
• Date observed: 2026-03-02
• Browser test via Playwright MCP

Steps to Reproduce

1. Open https://pulseclip.os.mieweb.org/
2. Start an upload flow that uses TUS resumable uploads.
3. Observe network requests.

Actual Behavior

• POST /uploads -> 201 Created
• PATCH /uploads/{uploadId} -> 405 Not Allowed
• Browser console error:
  Failed to load resource: the server responded with a status of 405 ()
• UI shows chunk upload failure and retry option.

Expected Behavior

PATCH /uploads/{uploadId} should be proxied to backend and return TUS-compliant response (e.g., 204 with updated Upload-Offset) until upload completion.

Evidence

Observed request sequence:

• GET /api/about -> 200
• GET /api/providers -> 200
• GET /api/featured -> 200
• POST /uploads -> 201
• PATCH /uploads/{id} -> 405

Suspected Root Cause

Proxy/routing mismatch at nginx:

• /uploads create route is reachable (POST works),
• but method handling for /uploads/:id likely blocks or misroutes PATCH.
  Possibilities:
• limit_except excludes PATCH
• /uploads matched by static location instead of upstream proxy
• method whitelist does not include TUS methods (OPTIONS, HEAD, PATCH, DELETE)

Scope / Impact

• PulseCam mobile upload flow is functionally broken in production for resumable uploads.
• Standard non-TUS file upload may still work (separate /api/upload path).

Proposed Fix

Update nginx config for /uploads to:

1. Proxy all /uploads traffic to Node/Express upstream
2. Allow TUS methods: OPTIONS, POST, HEAD, PATCH, DELETE
3. Keep request body streaming/size settings compatible with chunked uploads
4. Preserve TUS headers (e.g., Tus-Resumable, Upload-Offset, Upload-Length, Upload-Metadata)

Acceptance Criteria

• POST /uploads returns 201 in production
• PATCH /uploads/:id returns non-405 and advances Upload-Offset
• Full TUS upload completes successfully end-to-end
• No console errors related to /uploads/:id 405
• UI upload flow no longer shows chunk upload failure

Optional Follow-ups

• Add proxy integration test or smoke check for TUS methods
• Add production health/synthetic check for resumable upload route and methods
• Document required reverse-proxy method support for TUS in deployment docs

[horner]

@runleveldev Why wouldnt we allow all verbs?

[runleveldev]

The WAF is actually blocking this because of the Content-Type not the verb.

ModSecurity: Warning. Matched "Operator `Within' with parameter `|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/x-protobuf|' against variable `TX:content_type' (Value: `|application/offset+octet-stream|' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "937"] [id "920420"] [rev ""] [msg "Request content type is not allowed by policy"] [data "|application/offset+octet-stream|"] [severity "2"] [ver "OWASP_CRS/3.3.7"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "10.17.0.5"] [uri "/uploads/ba8662af-53d2-4acc-8c44-ff1904ebb26e"] [unique_id "0a910aa5afcbb0b925a63ea42311bfe4"] [ref "o0,31v386,31t:lowercase"]
ModSecurity: Access denied with code 405 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "81"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.7"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "10.17.0.5"] [uri "/uploads/ba8662af-53d2-4acc-8c44-ff1904ebb26e"] [unique_id "0a910aa5afcbb0b925a63ea42311bfe4"] [ref ""]

I just need to add application/offset+octet-stream to the allowed MIME types. Fixed in #220

[horner]

Interesting. I think the WAF should alert the owner of the container. It would have been helpful to know it was waf. Also we need to return a code shows a better error on the api.

This is tricky tho.

[horner]

Poonam told me that she was having issues with an application because of different verbs. So I assumed it was the same deal. I'm wondering what her issue was for her TimeHarbor