[AAP] Add response headers even if no appsec event is present#8784
Open
daniel-romano-DD wants to merge 5 commits into
Open
[AAP] Add response headers even if no appsec event is present#8784daniel-romano-DD wants to merge 5 commits into
daniel-romano-DD wants to merge 5 commits into
Conversation
BenchmarksBenchmark execution time: 2026-06-19 12:14:54 Comparing candidate commit cd84915 in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 71 metrics, 0 unstable metrics, 60 known flaky benchmarks, 66 flaky benchmarks without significant changes.
|
Contributor
|
daniel-romano-DD
force-pushed
the
dani/aap/add_response_headers_always
branch
from
fdeb404 to
74bf55d
Compare
Contributor
Author
|
@codex review |
daniel-romano-DD
force-pushed
the
dani/aap/add_response_headers_always
branch
from
74bf55d to
c4f484b
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74bf55dab4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+102
to
+103
| var headers = CanAccessHeaders ? _httpTransport.GetResponseHeaders() : new NameValueHeadersCollection(new NameValueCollection()); | ||
| AddHeaderTags(_span, headers, AlwaysResponseHeaders, SpanContextPropagator.HttpResponseHeadersTagPrefix); |
There was a problem hiding this comment.
When AppSec is enabled but the request is not an AppSec event, this new path now adds http.response.headers.content-type and http.response.headers.content-length to the span. The existing Security.AspNetCore5TraceTagging._.verified.txt snapshot still has the first two /Health spans (TraceTagging/v1 and TraceTagging/v2) without those tags, while the later event spans show that this endpoint does return both headers; since no verified snapshots were updated in this commit, AspNetCore5TraceTagging.TestTraceTaggingRules will fail snapshot verification.
Useful? React with 👍 / 👎.
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8784) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (75ms) : 71, 79
master - mean (73ms) : 71, 75
section Bailout
This PR (8784) - mean (79ms) : 75, 82
master - mean (77ms) : 75, 79
section CallTarget+Inlining+NGEN
This PR (8784) - mean (1,096ms) : 1046, 1146
master - mean (1,099ms) : 1063, 1135
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (117ms) : 113, 121
master - mean (114ms) : 111, 117
section Bailout
This PR (8784) - mean (116ms) : 112, 119
master - mean (117ms) : 112, 122
section CallTarget+Inlining+NGEN
This PR (8784) - mean (791ms) : 764, 818
master - mean (794ms) : 776, 813
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (101ms) : 98, 104
master - mean (100ms) : 97, 103
section Bailout
This PR (8784) - mean (101ms) : 99, 104
master - mean (103ms) : 99, 108
section CallTarget+Inlining+NGEN
This PR (8784) - mean (957ms) : 922, 992
master - mean (952ms) : 910, 994
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (102ms) : 97, 107
master - mean (100ms) : 96, 104
section Bailout
This PR (8784) - mean (101ms) : 97, 105
master - mean (100ms) : 98, 102
section CallTarget+Inlining+NGEN
This PR (8784) - mean (823ms) : 790, 855
master - mean (828ms) : 792, 864
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (202ms) : 198, 206
master - mean (200ms) : 195, 205
section Bailout
This PR (8784) - mean (205ms) : 202, 209
master - mean (204ms) : 200, 209
section CallTarget+Inlining+NGEN
This PR (8784) - mean (1,202ms) : 1162, 1242
master - mean (1,197ms) : 1156, 1238
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (290ms) : 283, 297
master - mean (286ms) : 275, 297
section Bailout
This PR (8784) - mean (289ms) : 283, 295
master - mean (288ms) : 283, 293
section CallTarget+Inlining+NGEN
This PR (8784) - mean (975ms) : 952, 997
master - mean (966ms) : 945, 987
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (282ms) : 276, 289
master - mean (282ms) : 274, 290
section Bailout
This PR (8784) - mean (283ms) : 279, 286
master - mean (281ms) : 272, 291
section CallTarget+Inlining+NGEN
This PR (8784) - mean (1,165ms) : 1136, 1193
master - mean (1,167ms) : 1123, 1211
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8784) - mean (281ms) : 272, 289
master - mean (279ms) : 268, 290
section Bailout
This PR (8784) - mean (283ms) : 275, 290
master - mean (278ms) : 272, 284
section CallTarget+Inlining+NGEN
This PR (8784) - mean (1,043ms) : 995, 1092
master - mean (1,042ms) : 999, 1085
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Contributor
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4f484b25e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Snapshots difference summaryThe following differences have been observed in committed snapshots. It is meant to help the reviewer. 4 occurrences of : + "http.response.headers.content-type": "text/plain; charset=utf-8",
2 occurrences of : + http.response.headers.content-length: 46,
+ http.response.headers.content-type: text/plain; charset=utf-8,
34 occurrences of : + http.response.headers.content-type: text/html; charset=utf-8,
1 occurrences of : + http.response.headers.content-length: 51,
+ http.response.headers.content-type: text/plain; charset=utf-8,
25 occurrences of : + http.response.headers.content-type: application/json; charset=utf-8,
4 occurrences of : + http.response.headers.content-length: 3,
+ http.response.headers.content-type: text/plain; charset=utf-8,
22 occurrences of : + http.response.headers.content-length: 0,
1 occurrences of : + http.response.headers.content-length: 18,
+ http.response.headers.content-type: text/plain; charset=utf-8,
1 occurrences of : + http.response.headers.content-length: 13,
+ http.response.headers.content-type: text/plain; charset=utf-8,
5 occurrences of : + http.response.headers.content-length: 49,
+ http.response.headers.content-type: text/plain; charset=utf-8,
2 occurrences of : + http.response.headers.content-length: 24,
+ http.response.headers.content-type: text/plain; charset=utf-8,
2 occurrences of : + http.response.headers.content-length: 4,
+ http.response.headers.content-type: application/json; charset=utf-8,
2 occurrences of : + http.response.headers.content-length: 35,
+ http.response.headers.content-type: application/json; charset=utf-8,
|
daniel-romano-DD
force-pushed
the
dani/aap/add_response_headers_always
branch
4 times, most recently
from
f177466 to
bd3d220
Compare
daniel-romano-DD
force-pushed
the
dani/aap/add_response_headers_always
branch
from
bd3d220 to
cd84915
Compare
e-n-0
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Always tag
http.response.headers.content-typeandhttp.response.headers.content-lengthon the root span when AppSec is enabled, regardless of whether a security event occurred.Reason for change
JIRA
These two headers are needed for accurate request characterisation in the backend (schema analysis, anomaly detection). Previously they were only emitted when the WAF produced a security event, leaving them absent on clean requests even when AppSec was enabled.
Implementation details
AlwaysResponseHeaders(containingcontent-typeandcontent-length) alongside the existingResponseHeadersdictionary inSecurityReporter.AddResponseHeadersToSpannow unconditionfrom the response and tags them. When asecurity event is present it falls through toAddResponseHeaderTagsas before, which tags all four response headers plus the endpoint tag.SecurityCoordinator.AddResponseHeadersToSpansimplified to delegate directly toReporter.AddResponseHeadersToSpanso both entry points share the same behaviour.Test coverage
Two new unit tests in
TraceTaggingResultTests:AddResponseHeadersToSpan_WithNoSecuriAndContentLength— assertscontent-typeandcontent-lengthare tagged when there is no security event, and thatcontent-encoding/content-languageareabsent.
AddResponseHeadersToSpan_WithSecurityEvent_AddsAllResponseHeaders— asserts all four response headers are tagged when the span is an AppSec event.Other details
N/A