fix: Correctly handle auth requests when subrequest logging is enabled#245
Conversation
…ing the span information to inject into the request (and for the WAF security context), we end up with 2 spans in this scenario, so do not assert that there's only one span and grab the last span to use for the context. This restores the the distributed tracing behavior from v1.6.2
…for them), change the behavior to inject the original root span's context into requests and security context, instead of the subrequest span.
cataphract
left a comment
There was a problem hiding this comment.
I think it's fine as a fix, although I wonder why we create more than one trace, instead of making the new request just a new span under the current trace
We do exactly as you say, we have one trace with two spans. However, I think there's some follow-up we can do to improve how we are handling the two separate spans and their data structures to improve our handling of these subrequest. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #245 +/- ##
==========================================
+ Coverage 68.61% 68.72% +0.10%
==========================================
Files 57 57
Lines 7322 7322
Branches 1035 1035
==========================================
+ Hits 5024 5032 +8
+ Misses 1796 1789 -7
+ Partials 502 501 -1
🚀 New features to boost your workflow:
|
Fixes a regression introduced by #231
Scenario
When NGINX is configured in a way to send subrequests, such as Authorization Based on Subrequest Result, we generally do not create a span for it. However, when NGINX is configured with
log_subrequest on;, we create aRequestTracingobject (and a span) for it, which causes a crashing error when we run the new assertion that there may only be oneRequestTracingobject present.Fix
Change the behavior so that when we are deciding what span context to inject into headers and register with the security context we 1) do not assert there's only one span and 2) we use the context from the root span.
Additional notes
In the PR I introduced a regression test to match the previous v1.6.2 nginx-datadog behavior. However, that showed that downstream span would become a child span of the auth subrequest instead of the root nginx span. This PR makes a breaking change so that: