Skip to content

fix: Correctly handle auth requests when subrequest logging is enabled#245

Merged
zacharycmontoya merged 5 commits intomasterfrom
zach.montoya/fix-single-trace-error
Sep 2, 2025
Merged

fix: Correctly handle auth requests when subrequest logging is enabled#245
zacharycmontoya merged 5 commits intomasterfrom
zach.montoya/fix-single-trace-error

Conversation

@zacharycmontoya
Copy link
Copy Markdown
Contributor

Fixes a regression introduced by #231

Scenario

When NGINX is configured in a way to send subrequests, such as Authorization Based on Subrequest Result, we generally do not create a span for it. However, when NGINX is configured with log_subrequest on;, we create a RequestTracing object (and a span) for it, which causes a crashing error when we run the new assertion that there may only be one RequestTracing object present.

Fix

Change the behavior so that when we are deciding what span context to inject into headers and register with the security context we 1) do not assert there's only one span and 2) we use the context from the root span.

Additional notes

In the PR I introduced a regression test to match the previous v1.6.2 nginx-datadog behavior. However, that showed that downstream span would become a child span of the auth subrequest instead of the root nginx span. This PR makes a breaking change so that:

  1. The downstream span is a child of the root nginx span (instead of the auth subrequest span)
  2. The security context is added to the root span (instead of the auth subrequest span)

…ing the span information to inject into the request (and for the WAF security context), we end up with 2 spans in this scenario, so do not assert that there's only one span and grab the last span to use for the context. This restores the the distributed tracing behavior from v1.6.2
…for them), change the behavior to inject the original root span's context into requests and security context, instead of the subrequest span.
@zacharycmontoya zacharycmontoya requested a review from a team as a code owner August 29, 2025 17:57
@zacharycmontoya zacharycmontoya requested review from Anilm3 and removed request for a team August 29, 2025 17:57
@dmehala dmehala requested a review from cataphract September 2, 2025 14:26
Copy link
Copy Markdown
Contributor

@cataphract cataphract left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's fine as a fix, although I wonder why we create more than one trace, instead of making the new request just a new span under the current trace

@zacharycmontoya
Copy link
Copy Markdown
Contributor Author

I think it's fine as a fix, although I wonder why we create more than one trace, instead of making the new request just a new span under the current trace

We do exactly as you say, we have one trace with two spans. However, I think there's some follow-up we can do to improve how we are handling the two separate spans and their data structures to improve our handling of these subrequest.

@codecov-commenter
Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.72%. Comparing base (6b51d05) to head (a00f092).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #245      +/-   ##
==========================================
+ Coverage   68.61%   68.72%   +0.10%     
==========================================
  Files          57       57              
  Lines        7322     7322              
  Branches     1035     1035              
==========================================
+ Hits         5024     5032       +8     
+ Misses       1796     1789       -7     
+ Partials      502      501       -1     
Files with missing lines Coverage Δ
src/datadog_context.cpp 67.33% <100.00%> (+2.01%) ⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zacharycmontoya zacharycmontoya merged commit 0e81220 into master Sep 2, 2025
58 checks passed
@zacharycmontoya zacharycmontoya deleted the zach.montoya/fix-single-trace-error branch September 2, 2025 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants