Missing http.response.headers.content-type span tag on blocking responses#10711
Open
Missing http.response.headers.content-type span tag on blocking responses#10711
Conversation
jandro996
added
type: bug
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 65 metrics, 6 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.055 s) : 0, 1055029
Total [baseline] (11.049 s) : 0, 11048526
Agent [candidate] (1.065 s) : 0, 1065121
Total [candidate] (11.056 s) : 0, 11055586
section appsec
Agent [baseline] (1.244 s) : 0, 1244441
Total [baseline] (11.138 s) : 0, 11138023
Agent [candidate] (1.243 s) : 0, 1243126
Total [candidate] (11.139 s) : 0, 11139457
section iast
Agent [baseline] (1.223 s) : 0, 1223195
Total [baseline] (11.306 s) : 0, 11306484
Agent [candidate] (1.235 s) : 0, 1234614
Total [candidate] (11.339 s) : 0, 11338661
section profiling
Agent [baseline] (1.187 s) : 0, 1186879
Total [baseline] (11.058 s) : 0, 11057599
Agent [candidate] (1.188 s) : 0, 1188160
Total [candidate] (11.025 s) : 0, 11025276
gantt
title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.196 ms) : 0, 1196
crashtracking [candidate] (1.202 ms) : 0, 1202
BytebuddyAgent [baseline] (626.615 ms) : 0, 626615
BytebuddyAgent [candidate] (631.26 ms) : 0, 631260
AgentMeter [baseline] (28.992 ms) : 0, 28992
AgentMeter [candidate] (29.354 ms) : 0, 29354
GlobalTracer [baseline] (256.155 ms) : 0, 256155
GlobalTracer [candidate] (258.332 ms) : 0, 258332
AppSec [baseline] (31.327 ms) : 0, 31327
AppSec [candidate] (31.836 ms) : 0, 31836
Debugger [baseline] (59.193 ms) : 0, 59193
Debugger [candidate] (59.78 ms) : 0, 59780
Remote Config [baseline] (589.463 µs) : 0, 589
Remote Config [candidate] (591.028 µs) : 0, 591
Telemetry [baseline] (8.583 ms) : 0, 8583
Telemetry [candidate] (8.695 ms) : 0, 8695
Flare Poller [baseline] (6.418 ms) : 0, 6418
Flare Poller [candidate] (7.973 ms) : 0, 7973
section appsec
crashtracking [baseline] (1.213 ms) : 0, 1213
crashtracking [candidate] (1.204 ms) : 0, 1204
BytebuddyAgent [baseline] (657.219 ms) : 0, 657219
BytebuddyAgent [candidate] (656.723 ms) : 0, 656723
AgentMeter [baseline] (11.96 ms) : 0, 11960
AgentMeter [candidate] (12.02 ms) : 0, 12020
GlobalTracer [baseline] (257.976 ms) : 0, 257976
GlobalTracer [candidate] (257.396 ms) : 0, 257396
IAST [baseline] (23.896 ms) : 0, 23896
IAST [candidate] (23.858 ms) : 0, 23858
AppSec [baseline] (177.284 ms) : 0, 177284
AppSec [candidate] (177.247 ms) : 0, 177247
Debugger [baseline] (65.451 ms) : 0, 65451
Debugger [candidate] (64.553 ms) : 0, 64553
Remote Config [baseline] (575.216 µs) : 0, 575
Remote Config [candidate] (571.05 µs) : 0, 571
Telemetry [baseline] (9.054 ms) : 0, 9054
Telemetry [candidate] (9.762 ms) : 0, 9762
Flare Poller [baseline] (3.559 ms) : 0, 3559
Flare Poller [candidate] (3.567 ms) : 0, 3567
section iast
crashtracking [baseline] (1.187 ms) : 0, 1187
crashtracking [candidate] (1.197 ms) : 0, 1197
BytebuddyAgent [baseline] (793.847 ms) : 0, 793847
BytebuddyAgent [candidate] (801.085 ms) : 0, 801085
AgentMeter [baseline] (11.299 ms) : 0, 11299
AgentMeter [candidate] (11.6 ms) : 0, 11600
GlobalTracer [baseline] (246.137 ms) : 0, 246137
GlobalTracer [candidate] (248.403 ms) : 0, 248403
IAST [baseline] (25.043 ms) : 0, 25043
IAST [candidate] (25.268 ms) : 0, 25268
AppSec [baseline] (26.176 ms) : 0, 26176
AppSec [candidate] (26.614 ms) : 0, 26614
Debugger [baseline] (63.1 ms) : 0, 63100
Debugger [candidate] (63.84 ms) : 0, 63840
Remote Config [baseline] (525.416 µs) : 0, 525
Remote Config [candidate] (534.956 µs) : 0, 535
Telemetry [baseline] (14.905 ms) : 0, 14905
Telemetry [candidate] (14.892 ms) : 0, 14892
Flare Poller [baseline] (4.945 ms) : 0, 4945
Flare Poller [candidate] (5.041 ms) : 0, 5041
section profiling
crashtracking [baseline] (1.16 ms) : 0, 1160
crashtracking [candidate] (1.191 ms) : 0, 1191
BytebuddyAgent [baseline] (684.957 ms) : 0, 684957
BytebuddyAgent [candidate] (686.955 ms) : 0, 686955
AgentMeter [baseline] (8.689 ms) : 0, 8689
AgentMeter [candidate] (8.609 ms) : 0, 8609
GlobalTracer [baseline] (216.631 ms) : 0, 216631
GlobalTracer [candidate] (216.438 ms) : 0, 216438
AppSec [baseline] (32.088 ms) : 0, 32088
AppSec [candidate] (32.137 ms) : 0, 32137
Debugger [baseline] (64.843 ms) : 0, 64843
Debugger [candidate] (63.849 ms) : 0, 63849
Remote Config [baseline] (588.754 µs) : 0, 589
Remote Config [candidate] (571.2 µs) : 0, 571
Telemetry [baseline] (9.091 ms) : 0, 9091
Telemetry [candidate] (9.727 ms) : 0, 9727
Flare Poller [baseline] (3.501 ms) : 0, 3501
Flare Poller [candidate] (3.54 ms) : 0, 3540
ProfilingAgent [baseline] (94.525 ms) : 0, 94525
ProfilingAgent [candidate] (93.928 ms) : 0, 93928
Profiling [baseline] (95.105 ms) : 0, 95105
Profiling [candidate] (94.481 ms) : 0, 94481
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.06 s) : 0, 1060468
Total [baseline] (8.842 s) : 0, 8842022
Agent [candidate] (1.064 s) : 0, 1064164
Total [candidate] (8.863 s) : 0, 8862817
section iast
Agent [baseline] (1.223 s) : 0, 1222771
Total [baseline] (9.569 s) : 0, 9569394
Agent [candidate] (1.234 s) : 0, 1234040
Total [candidate] (9.535 s) : 0, 9534797
gantt
title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.203 ms) : 0, 1203
crashtracking [candidate] (1.221 ms) : 0, 1221
BytebuddyAgent [baseline] (630.777 ms) : 0, 630777
BytebuddyAgent [candidate] (632.891 ms) : 0, 632891
AgentMeter [baseline] (29.395 ms) : 0, 29395
AgentMeter [candidate] (29.4 ms) : 0, 29400
GlobalTracer [baseline] (257.518 ms) : 0, 257518
GlobalTracer [candidate] (258.603 ms) : 0, 258603
AppSec [baseline] (31.544 ms) : 0, 31544
AppSec [candidate] (31.758 ms) : 0, 31758
Debugger [baseline] (58.917 ms) : 0, 58917
Debugger [candidate] (58.877 ms) : 0, 58877
Remote Config [baseline] (591.619 µs) : 0, 592
Remote Config [candidate] (591.44 µs) : 0, 591
Telemetry [baseline] (8.65 ms) : 0, 8650
Telemetry [candidate] (8.727 ms) : 0, 8727
Flare Poller [baseline] (5.672 ms) : 0, 5672
Flare Poller [candidate] (5.848 ms) : 0, 5848
section iast
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.218 ms) : 0, 1218
BytebuddyAgent [baseline] (793.448 ms) : 0, 793448
BytebuddyAgent [candidate] (802.545 ms) : 0, 802545
AgentMeter [baseline] (11.283 ms) : 0, 11283
AgentMeter [candidate] (11.583 ms) : 0, 11583
GlobalTracer [baseline] (246.555 ms) : 0, 246555
GlobalTracer [candidate] (247.655 ms) : 0, 247655
IAST [baseline] (25.112 ms) : 0, 25112
IAST [candidate] (25.125 ms) : 0, 25125
AppSec [baseline] (26.254 ms) : 0, 26254
AppSec [candidate] (26.415 ms) : 0, 26415
Debugger [baseline] (62.594 ms) : 0, 62594
Debugger [candidate] (62.808 ms) : 0, 62808
Remote Config [baseline] (521.286 µs) : 0, 521
Remote Config [candidate] (520.389 µs) : 0, 520
Telemetry [baseline] (14.807 ms) : 0, 14807
Telemetry [candidate] (14.898 ms) : 0, 14898
Flare Poller [baseline] (4.939 ms) : 0, 4939
Flare Poller [candidate] (5.043 ms) : 0, 5043
LoadParameters
See matching parameters
SummaryFound 4 performance improvements and 2 performance regressions! Performance is the same for 13 metrics, 17 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section baseline
no_agent (17.958 ms) : 17776, 18141
. : milestone, 17958,
appsec (18.533 ms) : 18345, 18722
. : milestone, 18533,
code_origins (17.676 ms) : 17499, 17854
. : milestone, 17676,
iast (18.394 ms) : 18210, 18579
. : milestone, 18394,
profiling (19.842 ms) : 19641, 20043
. : milestone, 19842,
tracing (18.261 ms) : 18080, 18441
. : milestone, 18261,
section candidate
no_agent (17.974 ms) : 17789, 18159
. : milestone, 17974,
appsec (19.418 ms) : 19219, 19618
. : milestone, 19418,
code_origins (18.876 ms) : 18687, 19066
. : milestone, 18876,
iast (17.896 ms) : 17717, 18075
. : milestone, 17896,
profiling (18.923 ms) : 18732, 19114
. : milestone, 18923,
tracing (17.735 ms) : 17557, 17913
. : milestone, 17735,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section baseline
no_agent (1.18 ms) : 1168, 1191
. : milestone, 1180,
iast (3.13 ms) : 3088, 3171
. : milestone, 3130,
iast_FULL (5.905 ms) : 5846, 5965
. : milestone, 5905,
iast_GLOBAL (3.746 ms) : 3675, 3816
. : milestone, 3746,
profiling (1.893 ms) : 1877, 1909
. : milestone, 1893,
tracing (1.778 ms) : 1763, 1793
. : milestone, 1778,
section candidate
no_agent (1.221 ms) : 1209, 1233
. : milestone, 1221,
iast (3.104 ms) : 3062, 3146
. : milestone, 3104,
iast_FULL (5.811 ms) : 5752, 5869
. : milestone, 5811,
iast_GLOBAL (3.517 ms) : 3462, 3572
. : milestone, 3517,
profiling (1.985 ms) : 1967, 2002
. : milestone, 1985,
tracing (1.811 ms) : 1797, 1825
. : milestone, 1811,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section baseline
no_agent (1.473 ms) : 1462, 1484
. : milestone, 1473,
appsec (3.735 ms) : 3518, 3953
. : milestone, 3735,
iast (2.25 ms) : 2181, 2319
. : milestone, 2250,
iast_GLOBAL (2.298 ms) : 2228, 2368
. : milestone, 2298,
profiling (2.086 ms) : 2031, 2141
. : milestone, 2086,
tracing (2.05 ms) : 1996, 2103
. : milestone, 2050,
section candidate
no_agent (1.477 ms) : 1466, 1489
. : milestone, 1477,
appsec (3.745 ms) : 3529, 3960
. : milestone, 3745,
iast (2.249 ms) : 2180, 2319
. : milestone, 2249,
iast_GLOBAL (2.296 ms) : 2227, 2366
. : milestone, 2296,
profiling (2.088 ms) : 2033, 2143
. : milestone, 2088,
tracing (2.061 ms) : 2007, 2114
. : milestone, 2061,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~e1f41734a9, baseline=1.61.0-SNAPSHOT~70410da0e2
dateFormat X
axisFormat %s
section baseline
no_agent (14.94 s) : 14940000, 14940000
. : milestone, 14940000,
appsec (14.808 s) : 14808000, 14808000
. : milestone, 14808000,
iast (18.232 s) : 18232000, 18232000
. : milestone, 18232000,
iast_GLOBAL (17.671 s) : 17671000, 17671000
. : milestone, 17671000,
profiling (14.578 s) : 14578000, 14578000
. : milestone, 14578000,
tracing (15.088 s) : 15088000, 15088000
. : milestone, 15088000,
section candidate
no_agent (15.598 s) : 15598000, 15598000
. : milestone, 15598000,
appsec (15.124 s) : 15124000, 15124000
. : milestone, 15124000,
iast (18.217 s) : 18217000, 18217000
. : milestone, 18217000,
iast_GLOBAL (17.765 s) : 17765000, 17765000
. : milestone, 17765000,
profiling (14.75 s) : 14750000, 14750000
. : milestone, 14750000,
tracing (15.172 s) : 15172000, 15172000
. : milestone, 15172000,
|
…ayBridge When a WAF blocking action fires, the normal response-header IG callbacks are bypassed, so http.response.headers.content-type never reaches the span. Instead of patching every framework's blocking handler, intercept the blocking flow result in GatewayBridge.maybePublishRequestData / maybePublishResponseData, compute the deterministic content-type from RequestBlockingAction + accept header, store it on AppSecRequestContext, and write it as a span tag in onRequestEnded(). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61447-bug-blocking
branch
from
ff53095 to
7fec408
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e1f41734a9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java
Show resolved
Hide resolved
dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java
Show resolved
Hide resolved
claponcet
approved these changes
Mar 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Ensures
http.response.headers.content-typeandhttp.response.headers.content-lengthspan tags are set on blocking responses (HTTP 403).When
GatewayBridge.maybePublishRequestData()ormaybePublishResponseData()returns aRequestBlockingAction, the blocking content-type and content-length are now computed deterministically from the action'sBlockingContentType+ the requestAcceptheader (usingBlockingActionHelper), stored onAppSecRequestContext, and written as span tags inonRequestEnded().Motivation
Blocking handlers short-circuit the normal request/response flow, bypassing the IG
responseHeadercallbacks. As a result,AppSecRequestContext.responseHeadersis never populated for blocking responses, andonRequestEnded()has nothing to write — causinghttp.response.headers.content-typeto be missing.Additional Notes
GatewayBridge— no per-framework changes required.agent-bootstrapis added ascompileOnlyto theappsecmodule soBlockingActionHelperis available at compile time. At runtime it is always accessible via the bootstrap classloader.securityResponseIdsubstitution.Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-61447
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.