feat: Update default trace propagation targets logic in the browser #10621
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lforst
changed the base branch from
develop
to
lforst-remove-tracing-origins
size-limit report 📦
|
lforst
changed the title
lforst
force-pushed
the
lforst-default-trace-prop-targets
branch
from
33ecd22 to
cfca488
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ['https://not-my-origin.com/api', /api/, true], | ||
|
|
||
| ['/api', /^\/api/, true], // matches pathname | ||
| ['/api', /\/\/my-origin\.com\/api/, true], // matches full url |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['/api', /\/\/my-origin\.com\/api/, true], // matches full url | ||
| ['foobar', /\/foobar/, true], // matches full url | ||
| ['foobar', /^\/api\/foobar/, true], // full url match | ||
| ['some-url.com', /\/some-url\.com/, true], |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['foobar', /\/foobar/, true], // matches full url | ||
| ['foobar', /^\/api\/foobar/, true], // full url match | ||
| ['some-url.com', /\/some-url\.com/, true], | ||
| ['some-url.com', /^\/some-url\.com/, false], // does not match pathname or full url |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['foobar', /^\/api\/foobar/, true], // full url match | ||
| ['some-url.com', /\/some-url\.com/, true], | ||
| ['some-url.com', /^\/some-url\.com/, false], // does not match pathname or full url | ||
| ['some-url.com', /^\/api\/some-url\.com/, true], // matches pathname |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['https://not-my-origin.com/api', /api/, true], | ||
|
|
||
| ['/api', /^\/api/, true], | ||
| ['/api', /\/\/my-origin\.com\/api/, false], |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['/api', /\/\/my-origin\.com\/api/, false], | ||
| ['foobar', /\/foobar/, false], | ||
| ['foobar', /^\/api\/foobar/, false], | ||
| ['some-url.com', /\/some-url\.com/, false], |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['foobar', /\/foobar/, false], | ||
| ['foobar', /^\/api\/foobar/, false], | ||
| ['some-url.com', /\/some-url\.com/, false], | ||
| ['some-url.com', /^\/some-url\.com/, false], |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
| ['foobar', /^\/api\/foobar/, false], | ||
| ['some-url.com', /\/some-url\.com/, false], | ||
| ['some-url.com', /^\/some-url\.com/, false], | ||
| ['some-url.com', /^\/api\/some-url\.com/, false], |
Check failure
Code scanning / CodeQL
Missing regular expression anchor
added 2 commits
February 13, 2024 14:23
AbhiPrasad
approved these changes
Feb 13, 2024
Lms24
approved these changes
Feb 13, 2024
added 3 commits
February 14, 2024 10:01
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this change, the default behaviour to which requests we added tracing headers when
tracePropagationTargetswere not defined was flawed:fetch("http://my-same-origin/api")) were not getting traced.fetch("http://api.localhost/posts")) were getting trace headers attached and causing CORS errors.We solve this by attaching tracing headers to all same-origin requests when
tracePropagationTargetsis not defined.Apart from that, our matching logic was not powerful enough:
fetchandxhras a comparator. E.g. When doingfetch("/api"), we only matchedtracePropagationTargetsagainst"/api"and not against the full URL. This makes it very hard to properly trace requests done by 3rd party libraries where you may not know whether they send the requests to"/api"or"${window.location.origin}/api".We aim to solve this by always comparing the provided
tracePropagationTargetsagainst the full URL to which the request is sent, and to preserve a certain degree of backwards compatibility, if users defined a relative matcher like/^\/api/, we also compare the definedtracePropagationTargetsagainst thepathame(in the technical sense), iff the request is a same-origin request. (The last part is important because we don't want to hand people a footgun to run into CORS errors.)Resolves #9764