503 error when loading plugin management page in NopCommerce 4.1

Hello,
This morning we started seeing that we are receiving a 503 - Service Unavailable error when attempting to view the plugin management page in the store administration for all of our NopCommerce 4.1 stores.  This prevents the plugin management page from loading.

We have found that the issue is in the Libraries\Nop.Core\Plugins\OfficialFeedManager.cs::GetDocument method where it attempts to connect to https://www.nopcommerce.com/extensionsxml.aspx, specifically in the calls for GetVersions (https://www.nopcommerce.com/extensionsxml.aspx?getVersions=1) and GetCategories (https://www.nopcommerce.com/extensionsxml.aspx?getCategories=1).  Strangely enough we are able to view those pages if we call them up in a browser.  We are seeing the same behavior both on our development servers as well as live production stores.

We have added a try...catch in the GetCategories, GetVersions, and GetAllPlugins methods (in the same file), returning an empty list in the catch, to get around this for now.

Has anyone else experienced this?  Trying to figure out if something changed on the NopCommerce side or if it is on our side (multiple different servers in multiple locations).

NopCommerce was down for some time earlier today. I suspect it was under DDOS attack so when the attempt to connect to NopCommerce was made the timeout period expired and caused the issue.
The plugin page mandatorily requires to connect to NopCommerce in version 4.1  and throws an exception if the connection could not be established. This is no longer the case in version 4.2.

Hello,

As of 12/5/2019 1:00PM Central Time US, the "official plugin feed" from NOP is still down.  When Admins go into the backend of our 4.1 stores, we are still getting the 503 error and are unable to add or remove plugins from our stores.  We also have 3.8 stores, and while the "local plugin" link works, clicking on the "All plugins and themes" returns the same 503 error.

Please let us know of the expected ETA for a resolution.  Currently we are patching our 4.1 stores with a Try/Catch that will return an empty list if "Official Plugin Feed" is not available, but anyone running pre-compiled source will not be able to do the patch and they are unable to add/remove plugins from their stores.

Thanks,

Brian

Hi Brian,
Sadly, I am not from the NopCommerc team so I can't provide you the expected ETA.
Maybe one of a team member from the NopCommerce can provide us the update.
I think nopcommerce has implemented the Cloudflare's DDOS protection which is blocking the request initiated by the web application.

We can verify this issue with Cloudflares anti DDoS blocking this request, becuase it does look like a bot request, and will be coming from nop instances all over the place - different IPs, so has the signature of a DDoS attack.

if the nop core team could please either stop this page from going through cloudflares proxy, or issue a patch for that plugin for 4.1 ASAP, that would be appreciated.

FYI all, same issue mentioned here: https://github.com/nopSolutions/nopCommerce/issues/3182
I'm hoping the nop team can set a cloudflare exception on that path quickly so we don't need to manually patch our 4.1 instances

Maybe it will be better if I posted the issue under the bug report so that one of the developers from the core team will be able to see this and fix this quickly.