Traefik retry middleware ↔ backend service: handling 409 Conflict on retries

Answer

Traefik does not automatically treat HTTP 409 Conflict as non‑retryable. Whether a retry occurs depends solely on the status‑code list you configure in the retry middleware. To avoid unintended duplicate writes on non‑idempotent requests, explicitly exclude 409 from that list (or rely on backend‑level deduplication).

Confirmed facts

• The retry middleware decides to retry based only on the attempts condition; it does not infer idempotency from the HTTP method.
• If 409 is present in the retryable status‑code list and the request is not idempotent, Traefik will resend the original request unchanged, potentially causing duplicate writes unless the backend deduplicates.
• Users can exclude specific status codes by listing only the codes they want to retry (e.g., 500, 502, 503, 504) and omitting 409.
• To signal idempotency for non‑idempotent methods (POST, PUT, PATCH) you must provide an Idempotency-Key header or rely on backend deduplication; Traefik does not add or interpret this header automatically.

Steps to prevent retries on 409 for a given route

1. Identify the retry middleware attached to the route (e.g., via traefik.http.middlewares..retry).
2. Edit its attempts condition to include only the status codes you consider retryable. Example TOML:

[http.middlewares.safe-retry.retry]\nattempts = 3\n# retry only on these server errors; 409 is omitted\nretryOn = [\"500\",\"502\",\"503\",\"504\"]\n

1. If the backend can safely deduplicate identical requests, you may keep 409 in the list and instead send an Idempotency-Key header from the client. Traefik will forward the header unchanged.
2. Apply the middleware to the router:

[http.routers.myapp.middlewares]\nmiddlewares = [\"safe-retry\"]\n

Diagnostic detail that could change the recommendation

Does your backend provide guaranteed deduplication or conditional logic for 409 responses? If yes, you may safely leave 409 in the retry list and rely on the backend to prevent duplicate writes; otherwise, exclude 409 as shown above.