Does WAF Automatically Retry When a Back-to-source Request Times Out?

No.

The back-to-source link from WAF to the origin server works based on the Nginx reverse proxy. The upstream retry behavior for a single request is affected by proxy_next_upstream, proxy_next_upstream_tries, and the number of available servers in upstream.

WAF does not explicitly configure proxy_next_upstream_tries. The default value 0 in Nginx is used. According to the definition in Nginx documentation, the default value indicates that the number of attempts is not limited. The actual number of attempts is still subject to the number of available servers in the current upstream.

In the WAF scenario, the retrieval target of each request is dynamically determined by the scheduling module in the request processing phase and bound to a single origin server. (Even if multiple origin servers are configured, only one origin server is selected as the retrieval target for each request.)

Therefore, for a single request, there is only one target in the current upstream for retrieval attempts. The total number of attempts, including the first retrieval attempt, is 1.

Therefore, when a connection timeout (connect_timeout), send timeout (send_timeout), or read timeout (read_timeout) occurs, WAF does not initiate another retrieval attempt for the request. Instead, it ends the retrieval process and returns an upstream access failure response, such as 504 Gateway Timeout, to the client.