Skip to content

[APPSEC-60728] Add analysis for downstream request with redirects#5347

Merged
Strech merged 10 commits into
masterfrom
appsec-60728-add-downstream-request-redirects-analysis
Feb 12, 2026
Merged

[APPSEC-60728] Add analysis for downstream request with redirects#5347
Strech merged 10 commits into
masterfrom
appsec-60728-add-downstream-request-redirects-analysis

Conversation

@Strech

@Strech Strech commented Feb 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What does this PR do?

Add redirect follow up for downstream request analysis. RFC took quick approach to remember redirect location and for any consequent request consider it a redirect hop if its URL matches the URL of the request.

Motivation:

This is a final part of API10 RFC: Annex A.

Change log entry

Yes. Add analysis for downstream requests with redirects (+ announcement).

Additional Notes:

Announcement:

This release introduces comprehensive instrumentation for downstream HTTP requests made by your application. AppSec RASP (Runtime Application Self-Protection) now automatically instruments outbound HTTP requests made via Faraday, Excon, and RestClient.

This includes capturing request/response headers, status codes, and JSON bodies, as well as tracking redirect chains to ensure complete visibility even when requests follow multiple hops.

Body analysis can be tuned to balance security coverage with performance:

Datadog.configure do |c|
  c.appsec.enabled = true
  
  # Percentage of downstream requests to analyze body content (0.0 to 1.0)
  # Default: 1.0 (analyze all requests)
  c.appsec.api_security.downstream_body_analysis.sample_rate = 0.8
  
  # Maximum number of request/response bodies to analyze per trace
  # Helps limit overhead in applications making many downstream calls
  # Default: 1
  c.appsec.api_security.downstream_body_analysis.max_requests = 3
end

How to test the change?

CI + ST

@github-actions github-actions Bot added integrations Involves tracing integrations appsec Application Security monitoring product labels Feb 11, 2026
@github-actions

github-actions Bot commented Feb 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Typing analysis

Note: Ignored files are excluded from the next sections.

steep:ignore comments

This PR introduces 2 steep:ignore comments, and clears 2 steep:ignore comments.

steep:ignore comments (+2-2) ❌ Introduced: 
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:121
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:123
✅ Cleared: 
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:90
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:91

Untyped methods

This PR introduces 1 partially typed method, and clears 1 partially typed method. It increases the percentage of typed methods from 59.96% to 59.98% (+0.02%).

Partially typed methods (+1-1) ❌ Introduced: 
sig/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rbs:10
└── def execute: () ?{ (*untyped) -> untyped } -> ::RestClient::Response
✅ Cleared: 
sig/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rbs:8
└── def execute: () ?{ (*untyped) -> untyped } -> ::RestClient::Response

If you believe a method or an attribute is rightfully untyped or partially typed, you can add # untyped:accept on the line before the definition to remove it from the stats.

@pr-commenter

pr-commenter Bot commented Feb 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-02-11 16:10:57

Comparing candidate commit f473d3e in PR branch appsec-60728-add-downstream-request-redirects-analysis with baseline commit ab36dce in branch master.

Found 0 performance improvements and 2 performance regressions! Performance is the same for 42 metrics, 2 unstable metrics.

scenario:tracing - Propagation - Trace Context

  • 🟥 throughput [-3384.473op/s; -3284.476op/s] or [-9.019%; -8.752%]

scenario:tracing - Tracing.log_correlation

  • 🟥 throughput [-10420.866op/s; -10118.935op/s] or [-9.550%; -9.273%]

@Strech
Strech marked this pull request as ready for review February 11, 2026 10:07
@Strech
Strech requested review from a team as code owners February 11, 2026 10:07
@Strech
Strech force-pushed the appsec-60728-add-downstream-request-redirects-analysis branch from ac7eadc to f473d3e Compare February 11, 2026 15:41
@datadog-official

datadog-official Bot commented Feb 11, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage
• Patch Coverage: 81.25%
• Overall Coverage: 95.10%

View detailed report

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f473d3e | Docs | Datadog PR Page | Was this helpful? Give us feedback!

y9v
y9v reviewed Feb 11, 2026
View reviewed changes
Comment thread appraisal/jruby-10.0.rb
Comment thread lib/datadog/appsec/contrib/excon/ssrf_detection_middleware.rb
@Strech
Strech merged commit 1578748 into master Feb 12, 2026
910 of 914 checks passed
@Strech
Strech deleted the appsec-60728-add-downstream-request-redirects-analysis branch February 12, 2026 09:27
@github-actions github-actions Bot added this to the 2.29.0 milestone Feb 12, 2026
@y9v y9v mentioned this pull request Feb 20, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@y9v y9v y9v approved these changes

Assignees

No one assigned

Labels

appsec Application Security monitoring product integrations Involves tracing integrations

Projects

None yet

Milestone

2.29.0

Development

Successfully merging this pull request may close these issues.

2 participants

@Strech @y9v