Skip to content

Conversation

florentinl
Copy link
Contributor

@florentinl florentinl commented Oct 9, 2025

What does this PR do?

The http.url_details.path tag is set by the backend as described in the span attributes guide of APM. When set by this tracer, it is replaced by the backend by a value parsed from the http.url which is always /.

Here is an example of a trace received from an API Gateway event where the route can be correctly determined but the path is wrongly set for this reason:
image

The path should be appended to the http.url tag instead.

Motivation

  • In the App and API Protection security traces explorer, we show the endpoint and the path is reported incorrectly for this reason.
image

instead of the expected:
image

Testing Guidelines

  • Updated snapshots
  • Updated unit tests
  • Tested with API Gateway events where scheme and host are extracted
  • Tested with ALB events where http.url is only set to the path

Additional Notes

Types of Changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog
  • This PR passes the integration tests (ask a Datadog member to run the tests)

@florentinl florentinl requested review from a team as code owners October 9, 2025 09:45
@florentinl florentinl marked this pull request as draft October 9, 2025 09:47
@florentinl florentinl force-pushed the florentin.labelle/APPSEC-59536/fix-http.url-path branch 2 times, most recently from c5d32a0 to f75eadb Compare October 9, 2025 09:59
@florentinl florentinl marked this pull request as ready for review October 9, 2025 11:47
http_tags["http.url_details.path"] = path
if http_tags.get("http.url"):
http_tags["http.url"] += path
else:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this fallback make sense? Do we want the url to be just the path if the preceding scheme://host cannot be found?

Not sure what the backend logic is here just want to confirm

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The spec isn't very clear on if it is intended or not but I could test it with an ALB (case where we have no url) and it works as you would expect.
The backend correctly deduces the http.url_details.path and it is also now deduce the http.pathgroup tag as well.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah lets just make sure the URL tag only has URL since other teams rely on it

@florentinl florentinl force-pushed the florentin.labelle/APPSEC-59536/fix-http.url-path branch from f75eadb to 6117d29 Compare October 14, 2025 14:02
@florentinl florentinl merged commit 56152da into main Oct 14, 2025
81 of 82 checks passed
@florentinl florentinl deleted the florentin.labelle/APPSEC-59536/fix-http.url-path branch October 14, 2025 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants