Repository: traefik/traefik (language: go)

Issue:
Potential DDoS on traefik instance (slowloris attack)?
### Welcome!

- [X] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

I'm uncertain about the relevance of this observation, but I believe it's worth noting as it may indicate a potential issue.

## How to Reproduce

Start traefik:

```
docker run --rm -p 8080:80 traefik --log.level=debug --certificatesresolvers.http.acme.httpchallenge.entrypoint=http
docker run --rm -p 8080:80 traefik:v3.0 --log.level=debug --certificatesresolvers.http.acme.httpchallenge.entrypoint=http
```

And then run:
```
time curl -v localhost:8080/.well-known/acme-challenge/non-existing-token
```


### What did you see instead?

The 404 error code but  in a significant delay of up to approximately 50 seconds.


### What version of Traefik are you using?

Version:      3.0.0-beta4
Codename:     beaufort
Go version:   go1.21.3
Built:        2023-10-12T07:53:33Z
OS/Arch:      linux/amd64

Version:      2.10.5
Codename:     saintmarcelin
Go version:   go1.21.3
Built:        2023-10-11T13:54:02Z
OS/Arch:      linux/amd64


### What is your environment & configuration?

```yaml
# (paste your configuration here)
```

Add more configuration information here.


### If applicable, please paste the log output in DEBUG level

_No response_


Discussion / hints:
Hello @rjsocha,

Thanks for the bug, we were able to reproduce it and will be working on a fix soon!

Fix patch:
diff --git a/pkg/provider/acme/challenge_http.go b/pkg/provider/acme/challenge_http.go
index a6eaf32d92..4537c34a0e 100644
--- a/pkg/provider/acme/challenge_http.go
+++ b/pkg/provider/acme/challenge_http.go
@@ -11,10 +11,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/cenkalti/backoff/v4"
 	"github.com/go-acme/lego/v4/challenge/http01"
 	"github.com/traefik/traefik/v2/pkg/log"
-	"github.com/traefik/traefik/v2/pkg/safe"
 )
 
 // ChallengeHTTP HTTP challenge provider implements challenge.Provider.
@@ -105,35 +103,18 @@ func (c *ChallengeHTTP) getTokenValue(ctx context.Context, token, domain string)
 	logger := log.FromContext(ctx)
 	logger.Debugf("Retrieving the ACME challenge for %s (token %q)...", domain, token)
 
-	var result []byte
-
-	operation := func() error {
-		c.lock.RLock()
-		defer c.lock.RUnlock()
-
-		if _, ok := c.httpChallenges[token]; !ok {
-			return fmt.Errorf("cannot find challenge for token %q (%s)", token, domain)
-		}
-
-		var ok bool
-		result, ok = c.httpChallenges[token][domain]
-		if !ok {
-			return fmt.Errorf("cannot find challenge for %s (token %q)", domain, token)
-		}
+	c.lock.RLock()
+	defer c.lock.RUnlock()
 
+	if _, ok := c.httpChallenges[token]; !ok {
+		logger.Errorf("Cannot retrieve the ACME challenge for %s (token %q)", domain, token)
 		return nil
 	}
 
-	notify := func(err error, time time.Duration) {
-		logger.Errorf("Error getting challenge for token retrying in %s", time)
-	}
-
-	ebo := backoff.NewExponentialBackOff()
-	ebo.MaxElapsedTime = 60 * time.Second
-	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-	if err != nil {
-		logger.Errorf("Cannot retrieve the ACME challenge for %s (token %q): %v", domain, token, err)
-		return []byte{}
+	result, ok := c.httpChallenges[token][domain]
+	if !ok {
+		logger.Errorf("Cannot retrieve the ACME challenge for %s (token %q)", domain, token)
+		return nil
 	}
 
 	return result


Test patch: