Skip to content

Keep http.status_code when the Lambda AppSec context is missing #12623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
claponcet merged 2 commits into from
Sep 24, 2026
+39 −9
Merged

Keep http.status_code when the Lambda AppSec context is missing #12623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
92a6adf
Keep http.status_code when the Lambda AppSec context is missing
joey-zhao_ddog Sep 24, 2026
42f0e06
Restore comment explaining the null trigger type check
joey-zhao_ddog Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions dd-trace-core/src/main/java/datadog/trace/lambda/LambdaAppSecHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,8 @@ public static void processRequestEnd(AgentSpan span) {
return;
}

// A null trigger type means processRequestStart never ran, so the invocation was not analysed
// at all, which is not the same as an unsupported trigger.
if (!triggerType.isHttp()) {
span.setMetric(UNSUPPORTED_EVENT_TYPE_METRIC, 1);
return;
Expand Down Expand Up @@ -189,10 +191,8 @@ public static void processResponseData(AgentSpan span, Object result) {
}

RequestContext requestContext = span.getRequestContext();
if (requestContext == null || requestContext.getData(RequestContextSlot.APPSEC) == null) {
log.debug("Span has no AppSec request context, skipping response processing");
return;
}
boolean hasAppSecContext =
requestContext != null && requestContext.getData(RequestContextSlot.APPSEC) != null;

try {
byte[] bytes = ((ByteArrayOutputStream) result).toByteArray();
Expand All @@ -219,6 +219,14 @@ public static void processResponseData(AgentSpan span, Object result) {
span.setError(isError, ErrorPriorities.HTTP_SERVER_DECORATOR);
}

// http.status_code is a tracing tag and is published above whether or not AppSec ran: a
// failure inside processRequestStart must not also cost the span its status. The WAF
// callbacks below, in contrast, have nowhere to deliver without an AppSec request context.
if (!hasAppSecContext) {
log.debug("Span has no AppSec request context, skipping response WAF callbacks");
return;
}

AgentTracer.TracerAPI tracer = AgentTracer.get();
CallbackProvider cbp = tracer.getCallbackProvider(RequestContextSlot.APPSEC);

Expand Down
32 changes: 27 additions & 5 deletions dd-trace-core/src/test/java/datadog/trace/lambda/LambdaAppSecHandlerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1753,13 +1753,35 @@ void processResponseDataDoesNothingForNullResult() {
}

@Test
void processResponseDataDoesNothingWhenSpanHasNoRequestContext() {
void processResponseDataPublishesStatusButNoWafEventsWhenSpanHasNoRequestContext() {
LambdaAppSecHandler.setCurrentTriggerType(LambdaTriggerType.API_GATEWAY_V1_REST);
AgentSpan span = mock(AgentSpan.class);
when(span.getRequestContext()).thenReturn(null);
ByteArrayOutputStream result = createOutputStream("{\"statusCode\": 200}");
setupMockResponseCallbacks(null, null, null, null);
LambdaAppSecHandler.processResponseData(span, result);
// no exception expected
AgentTracer.TracerAPI tracer = mock(AgentTracer.TracerAPI.class);
AgentTracer.forceRegister(tracer);

LambdaAppSecHandler.processResponseData(span, createOutputStream("{\"statusCode\": 200}"));

verify(span).setHttpStatusCode(200);
verify(tracer, never()).getCallbackProvider(RequestContextSlot.APPSEC);
}

@Test
void processResponseDataStillPublishesStatusWhenSpanHasNoAppSecContext() {
// An exception inside processRequestStart leaves an HTTP trigger type recorded but no AppSec
// context on the span. http.status_code is a tracing tag and must survive that.
LambdaAppSecHandler.setCurrentTriggerType(LambdaTriggerType.API_GATEWAY_V1_REST);
RequestContext requestContext = mock(RequestContext.class);
AgentSpan span = mock(AgentSpan.class);
when(span.getRequestContext()).thenReturn(requestContext);
AgentTracer.TracerAPI tracer = mock(AgentTracer.TracerAPI.class);
AgentTracer.forceRegister(tracer);

LambdaAppSecHandler.processResponseData(
span, createOutputStream("{\"statusCode\": 503, \"body\": \"boom\"}"));

verify(span).setHttpStatusCode(503);
verify(tracer, never()).getCallbackProvider(RequestContextSlot.APPSEC);
}

@Test
Expand Down
Loading