feat(aap): In App WAF support by CarlesDD · Pull Request #744 · DataDog/datadog-lambda-js

CarlesDD · 2026-03-16T06:48:38Z

What does this PR do?

Adds AppSec support to the Lambda layer by extracting HTTP data from Lambda events and publishing it to diagnostic channels consumed by dd-trace-js's AppSec subsystem.

Changes:

Dockerfile + move script: move_ddtrace_dependency.js now reads @datadog/native-appsec from dd-trace's optionalDependencies and promotes it to a direct dependency so it survives --ignore-optional. The Dockerfile runs the script before rm -rf node_modules and strips unused native prebuilds (non-Linux-glibc platforms)
Event data extractor (src/appsec/event-data-extractor.ts): Parses API Gateway v1/v2, ALB, and Lambda Function URL events, extracting headers, method, path, query, body, client IP, path params, cookies, and route
Orchestrator (src/appsec/index.ts): Checks DD_APPSEC_ENABLED and publishes extracted data to datadog:lambda:start-invocation / datadog:lambda:end-invocation diagnostic channels
TraceListener integration: initAppsec() called in onStartInvocation, processAppSecRequest and processAppSecResponse called in onEndingInvocation

Motivation

Porting the In-App WAF security product to AWS Lambda for the Node.js runtime. The Lambda layer extracts HTTP data and dispatches it to the tracer for WAF execution and reporting.

The layer is intentionally kept thin, only extracting and publishing data. All security logic (WAF, reporting, trace keeping) lives in dd-trace-js.

Testing Guidelines

Unit tests for the event data extractor cover all 4 HTTP event types (API GW v1/v2, ALB, Lambda Function URL) and non-HTTP events
Unit tests for the orchestrator verify configuration gating and channel publishing
Existing listener tests pass unchanged

Additional Notes

@datadog/native-appsec is NOT added to this repo's package.json. The version is read dynamically from dd-trace's optionalDependencies at build time, so dd-trace-js remains the single owner of the native module version.
No new environment variables, using the existing DD_APPSEC_ENABLED.
This is a monitoring-only first iteration. Blocking, Remote Config, and telemetry are out of scope.
Companion PR in dd-trace-js: feat(aap): In App WAF support for lambda dd-trace-js#7783

Types of Changes

Bug fix
New feature
Breaking change
Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

This PR's description is comprehensive
This PR contains breaking changes that are documented in the description
This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
This PR impacts documentation, and it has been updated (or a ticket has been logged)
This PR's changes are covered by the automated tests
This PR collects user input/sensitive content into Datadog
This PR passes the integration tests (ask a Datadog member to run the tests)

APPSEC-60752

datadog-datadog-prod-us1 · 2026-06-16T20:00:28Z

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/datadog-lambda-js | e2e-test-status

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 18d7d47 | Docs | Datadog PR Page | Give us feedback!}

purple4reina · 2026-07-13T15:38:17Z

    if (!this.tracerWrapper.currentSpan) return false;
    this.wrappedCurrentSpan = new SpanWrapper(this.tracerWrapper.currentSpan, {});
+
+    processAppsecRequest(event, this.tracerWrapper.currentSpan);


Should this happen at the beginning of the invocation? I'm wondering if this should be moved to onStartInvocation.

Good catch. processAppsecRequest ran after the handler, too late to ever support blocking. Moved it to onRequestStart, called right before the handler runs, once the span is active. Couldnt be onStartInvocation itself since the span doesnt exist yet there.

purple4reina · 2026-07-14T17:51:44Z

+   * @param event
+   */
+  public onRequestStart(event: any): void {
+    processAppsecRequest(event, this.tracerWrapper.currentSpan);


Is there a reason we can't just put this into onStartInvocation?

Yes, there is. onStartInvocation runs before onWrap even creates the span (tracer.wrap() activates it later, wrapping the handler invocation itself), so currentSpan would be null there. onRequestStart is the earliest point where the span is guaranteed active, right before the handler runs.

purple4reina · 2026-07-14T17:54:07Z

  }

  public async onStartInvocation(event: any, context: Context) {
+    initAppsec();


Looks like there's a this.config object available. Makes sense to add the appsec enabled check to the config.

Added appsecEnabled to TraceConfig, resolved from DD_APPSEC_ENABLED in getConfig() like every other flag.

…n dd-trace-js

… not after

…ing env directly

purple4reina · 2026-07-16T21:06:50Z

    }
+    const responseStatusCode = result?.statusCode?.toString();
+    const responseHeaders = result?.headers as Record<string, string> | undefined;
+    processAppsecResponse(this.tracerWrapper.currentSpan, responseStatusCode, responseHeaders);


Can we move the is appsec enabled check to wrap this new block? That way none of it will execute if appsec isn't enabled. It will also make it easier to see on a quick read that this section is skipped in most cases.

nit. I would make the signature of this method like

processAppsecResponse(this.tracerWrapper.currentSpan, result)

Do the extraction of the status code and headers inside the function, rather than before it. That keeps this already long onEndInvocation method neater and puts the extraction of the data closer to where you'll use it.

purple4reina · 2026-07-16T21:08:06Z

  }

  public async onStartInvocation(event: any, context: Context) {
+    initAppsec(this.config.appsecEnabled);


This doesn't seem necessary anymore now that we've moved the bool to the config. We should just use this.config.appsecEnabled around the processAppsecRequest and processAppsecResponse methods directly.

purple4reina · 2026-07-16T21:12:25Z

+let enabled = false;
+
+export function initAppsec(appsecEnabled: boolean): void {
+  enabled = appsecEnabled;
+}


I think these lines can be removed as long as we do the appsec enabled check just before each process call.

purple4reina

Just a couple of small nitpicks. Otherwise, everything looks great.

…dule-level enabled state

…cResponse

purple4reina · 2026-07-17T16:48:11Z

Next steps to merge:

We'll need to increase the allowed binary size check since we're now bundling @datadog/native-appsec. We'll need to update the numbers here:

datadog-lambda-js/scripts/check_layer_size.sh

Lines 11 to 12 in 621e9a1

MAX_LAYER_COMPRESSED_SIZE_KB=$(expr 7 \* 1024)

MAX_LAYER_UNCOMPRESSED_SIZE_KB=$(expr 19 \* 1024)
Once those tests are fixed, the e2e tests will run. We have tests already that check for appsec when DD_APPSEC_ENABLED=true. Currently, nodejs tests are marked as xfail, so this change should make them start passing. We have the tests configured to alert us when a test unexpectedly passes. So, we would expect the nodejs appsec in tracer tests to be listed as failures. If that makes any sense. I say just ping me when the e2e tests have finished running, before you merge, and I'll take a look.

CarlesDD mentioned this pull request Mar 16, 2026

feat(aap): In App WAF support for lambda DataDog/dd-trace-js#7783

Merged

IlyasShabi reviewed Mar 17, 2026

View reviewed changes

Comment thread scripts/move_ddtrace_dependency.js Outdated

IlyasShabi reviewed Mar 17, 2026

View reviewed changes

Comment thread src/trace/listener.ts Outdated

IlyasShabi reviewed Mar 17, 2026

View reviewed changes

Comment thread src/appsec/event-data-extractor.ts

IlyasShabi reviewed Mar 17, 2026

View reviewed changes

Comment thread src/appsec/event-data-extractor.ts

CarlesDD force-pushed the ccapell/APPSEC-60752/in-app-waf-port branch from a9a47e9 to a79197a Compare April 21, 2026 15:06

uurien reviewed Jun 10, 2026

View reviewed changes

Comment thread src/appsec/index.ts Outdated

IlyasShabi approved these changes Jun 29, 2026

View reviewed changes

CarlesDD marked this pull request as ready for review June 30, 2026 05:58

CarlesDD requested review from a team as code owners June 30, 2026 05:58

CarlesDD requested a review from shreyamalpani June 30, 2026 05:58

purple4reina reviewed Jul 13, 2026

View reviewed changes

purple4reina reviewed Jul 14, 2026

View reviewed changes

CarlesDD added 14 commits July 16, 2026 20:11

Remove unused native-appsec binaries + native-appsec version pinned i…

a9fffb5

…n dd-trace-js

Extract event data and pass it over dc

6f6644e

Fix linting issues

2c02b6e

Fix formatting issue

9d54432

Fix test mock

ccda597

Fix typo. Add test for Appsec integration in listener

84f05f2

Avoid including cookies and route when they are undefined

896f723

Rework for native-appsec package dependency

b0acc36

Clean format

3241d3e

Updated yarn.lock

7553eb6

Case insensitive enablement env var

a7f307e

Fix Appsec reported path for APIGW v1

52ced89

Add tag for unsupported event type

87cab59

Minor fixes

9888635

CarlesDD added 3 commits July 16, 2026 20:15

update dd-trace-js

160cc17

fix(appsec): process AppSec request before invoking the user handler,…

ef54676

… not after

fix(appsec): resolve DD_APPSEC_ENABLED through config instead of read…

fde79ca

…ing env directly

CarlesDD force-pushed the ccapell/APPSEC-60752/in-app-waf-port branch from a2945c1 to fde79ca Compare July 16, 2026 18:16

chore: regenerate yarn.lock for dd-trace ^5.113.0 after rebase

c743a31

CarlesDD requested a review from purple4reina July 16, 2026 19:31

purple4reina reviewed Jul 16, 2026

View reviewed changes

CarlesDD added 3 commits July 17, 2026 12:22

refactor(appsec): gate on config.appsecEnabled at call sites, drop mo…

c79752d

…dule-level enabled state

refactor(appsec): extract response status/headers inside processAppse…

7eabe4a

…cResponse

style: remove leftover blank lines in listener.ts

a0081d9

purple4reina approved these changes Jul 17, 2026

View reviewed changes

CarlesDD added 2 commits July 17, 2026 19:35

chore: bump layer size limits to 9mb/23mb for @datadog/native-appsec

cfd7de1

chore: bump layer size limits to 9mb/24mb for @datadog/native-appsec

18d7d47

CarlesDD merged commit 06813d2 into main Jul 17, 2026
41 of 42 checks passed

CarlesDD deleted the ccapell/APPSEC-60752/in-app-waf-port branch July 17, 2026 20:07

Uh oh!

Conversation

CarlesDD commented Mar 16, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Testing Guidelines

Additional Notes

Types of Changes

Check all that apply

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-datadog-prod-us1 Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

purple4reina left a comment

Choose a reason for hiding this comment

Uh oh!

purple4reina commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CarlesDD commented Mar 16, 2026 •

edited by atlassian Bot

Loading

datadog-datadog-prod-us1 Bot commented Jun 16, 2026 •

edited

Loading