Skip to content

fix(http): preserve CORS tracing allow headers - #9795

Open
pabloerhard wants to merge 4 commits into
masterfrom
pabloerhard/fix-allow-list
Open

fix(http): preserve CORS tracing allow headers#9795
pabloerhard wants to merge 4 commits into
masterfrom
pabloerhard/fix-allow-list

Conversation

@pabloerhard

@pabloerhard pabloerhard commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Updates CORS preflight handling so tracing headers merged into access-control-allow-headers are also written back to explicit headers passed through the second or third ServerResponse.writeHead() argument.

The explicit header collection is handled case-insensitively and retains Node.js object or flat-array form. Calls that do not need an allow-list update continue to receive their original arguments unchanged.

Motivation

Node.js gives headers passed directly to writeHead() precedence over values previously set with res.setHeader(). As a result, an application-provided value such as content-type could overwrite the computed content-type,baggage allow-list and cause the browser preflight to fail.

Additional Notes

Validation:

  • ./node_modules/.bin/mocha packages/dd-trace/test/plugins/util/web.spec.js — 81 passing
  • ./node_modules/.bin/mocha packages/datadog-plugin-http/test/server.spec.js — 56 passing
  • Focused NYC coverage for web.js — 91.86% lines
  • git diff --check and syntax checks pass

@pabloerhard

Copy link
Copy Markdown
Contributor Author

@codex review

@dd-octo-sts

dd-octo-sts Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 8.15 MB
Deduped: 8.81 MB
No deduping: 8.81 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.3 | 125.43 kB | 441.68 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Aug 12, 2026

Copy link
Copy Markdown

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 98.52% (-0.04%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 481723b | Docs | Datadog PR Page | Give us feedback!

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62ddd89b5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/dd-trace/src/plugins/util/web.js Outdated
Comment thread packages/dd-trace/src/plugins/util/web.js Outdated
Comment thread packages/dd-trace/src/plugins/util/web.js Outdated
@codecov

codecov Bot commented Aug 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.52%. Comparing base (f72b07e) to head (481723b).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #9795      +/-   ##
==========================================
- Coverage   98.56%   98.52%   -0.04%     
==========================================
  Files         972      975       +3     
  Lines      140837   142796    +1959     
  Branches    12116    12163      +47     
==========================================
+ Hits       138811   140687    +1876     
- Misses       2026     2109      +83     
Flag Coverage Δ
aiguard 57.37% <3.79%> (-0.15%) ⬇️
aiguard-integration 55.61% <7.59%> (-0.09%) ⬇️
apm-bucket-0 56.85% <3.79%> (-0.41%) ⬇️
apm-bucket-1 63.00% <30.37%> (-0.38%) ⬇️
apm-bucket-2 61.84% <30.37%> (-0.39%) ⬇️
apm-bucket-3 59.45% <30.37%> (-0.37%) ⬇️
apm-capabilities-tracing 62.51% <100.00%> (+<0.01%) ⬆️
apm-integrations-aerospike 55.70% <3.79%> (-0.60%) ⬇️
apm-integrations-confluentinc-kafka-javascript 60.78% <3.79%> (-0.43%) ⬇️
apm-integrations-couchbase 56.35% <3.79%> (-0.39%) ⬇️
apm-integrations-http 61.56% <30.37%> (-0.36%) ⬇️
apm-integrations-kafkajs 61.30% <3.79%> (-0.44%) ⬇️
apm-integrations-next 59.06% <30.37%> (-0.36%) ⬇️
apm-integrations-prisma 58.17% <3.79%> (-0.37%) ⬇️
appsec 71.71% <30.37%> (-0.39%) ⬇️
appsec-express_fastify_graphql 69.08% <30.37%> (-0.35%) ⬇️
appsec-integration 49.84% <7.59%> (-0.30%) ⬇️
appsec-kafka_ldapjs_lodash 63.06% <30.37%> (-0.36%) ⬇️
appsec-mongodb-core_mongoose_mysql 66.53% <30.37%> (-0.35%) ⬇️
appsec-next 56.39% <30.37%> (-0.30%) ⬇️
appsec-node-serialize_passport_postgres 65.94% <30.37%> (-0.35%) ⬇️
appsec-sourcing_stripe_template 64.38% <30.37%> (-0.35%) ⬇️
debugger 63.86% <30.37%> (-0.39%) ⬇️
instrumentations-bucket-0 51.35% <3.79%> (-0.35%) ⬇️
instrumentations-bucket-1 59.31% <30.37%> (-0.37%) ⬇️
instrumentations-bucket-10 60.56% <30.37%> (-0.35%) ⬇️
instrumentations-bucket-11 61.21% <30.37%> (-0.35%) ⬇️
instrumentations-bucket-12 51.27% <3.79%> (-0.35%) ⬇️
instrumentations-bucket-13 52.12% <3.79%> (-0.34%) ⬇️
instrumentations-bucket-14 51.37% <3.79%> (-0.35%) ⬇️
instrumentations-bucket-2 52.60% <3.79%> (-0.34%) ⬇️
instrumentations-bucket-3 53.25% <3.79%> (-0.35%) ⬇️
instrumentations-bucket-4 58.39% <30.37%> (-0.36%) ⬇️
instrumentations-bucket-5 49.14% <3.79%> (-0.29%) ⬇️
instrumentations-bucket-6 59.92% <30.37%> (-0.38%) ⬇️
instrumentations-bucket-7 51.56% <3.79%> (-0.35%) ⬇️
instrumentations-bucket-8 58.09% <30.37%> (-0.34%) ⬇️
instrumentations-bucket-9 56.89% <3.79%> (-0.39%) ⬇️
instrumentations-instrumentation-couchbase 50.39% <3.79%> (-0.57%) ⬇️
instrumentations-integration-esbuild 33.85% <3.79%> (-0.36%) ⬇️
llmobs-ai_anthropic_bedrock 62.51% <3.79%> (-0.37%) ⬇️
llmobs-bucket-1 61.02% <3.79%> (-0.34%) ⬇️
llmobs-openai 61.39% <3.79%> (-0.38%) ⬇️
llmobs-openai-agents_vertex-ai 59.69% <3.79%> (-0.36%) ⬇️
llmobs-sdk 66.93% <3.79%> (+0.13%) ⬆️
master-coverage 98.52% <100.00%> (?)
openfeature 55.34% <7.59%> (-0.34%) ⬇️
openfeature-unit 52.97% <3.79%> (-0.26%) ⬇️
platform-core_esbuild_instrumentations-misc 40.99% <3.79%> (-0.25%) ⬇️
platform-integration 60.06% <7.59%> (-0.37%) ⬇️
platform-shimmer_unit-guardrails_webpack 38.60% <3.79%> (-0.30%) ⬇️
plugins-bucket-0 56.61% <3.79%> (-0.35%) ⬇️
plugins-bucket-1 53.68% <7.59%> (-0.35%) ⬇️
plugins-bucket-11 61.12% <30.37%> (-0.65%) ⬇️
plugins-bucket-14 ?
plugins-bucket-17 60.94% <30.37%> (-0.40%) ⬇️
plugins-bucket-18 61.56% <3.79%> (+3.46%) ⬆️
plugins-bucket-19 60.96% <30.37%> (-0.43%) ⬇️
plugins-bucket-20 63.34% <30.37%> (+1.63%) ⬆️
plugins-bucket-4 57.98% <30.37%> (-0.35%) ⬇️
plugins-bullmq_cassandra_cookie 60.98% <3.79%> (-0.42%) ⬇️
plugins-cookie-parser_crypto_dd-trace-api 55.99% <3.79%> (-0.39%) ⬇️
plugins-fetch_fs_generic-pool 57.90% <3.79%> (-0.35%) ⬇️
plugins-google-cloud-pubsub_grpc_handlebars 63.78% <30.37%> (-0.40%) ⬇️
plugins-hapi_hono_ioredis 59.56% <30.37%> (-0.37%) ⬇️
plugins-knex_langgraph_ldapjs 54.73% <3.79%> (-0.37%) ⬇️
plugins-light-my-request_limitd-client_lodash 58.04% <30.37%> (?)
plugins-light-my-request_lodash_mariadb ?
plugins-mariadb_memcached_mercurius 60.96% <30.37%> (?)
plugins-memcached_mercurius_microgateway-core ?
plugins-mongodb-core_mongoose_multer ?
plugins-mongodb_mongodb-core_mongoose 58.89% <3.79%> (?)
plugins-multer_mysql_mysql2 58.47% <3.79%> (?)
plugins-mysql_mysql2_nats ?
plugins-nats_node-serialize_opensearch 60.01% <3.79%> (?)
plugins-passport-http_pino_postgres 58.22% <3.79%> (?)
plugins-pino_postgres_process ?
plugins-process_pug_redis 57.02% <3.79%> (?)
plugins-pug_redis_router ?
plugins-undici_url_valkey 57.68% <3.79%> (?)
plugins-url_valkey_vm ?
plugins-vm_winston_ws 59.21% <3.79%> (?)
plugins-winston_ws ?
profiling 61.34% <30.37%> (-0.19%) ⬇️
serverless-aws-sdk-aws-sdk 54.84% <3.79%> (-0.32%) ⬇️
serverless-aws-sdk-base-inject-field 50.59% <3.79%> (-0.35%) ⬇️
serverless-aws-sdk-bedrockruntime 54.35% <3.79%> (-0.34%) ⬇️
serverless-aws-sdk-client 55.89% <3.79%> (-0.36%) ⬇️
serverless-aws-sdk-dynamodb 55.18% <3.79%> (-0.35%) ⬇️
serverless-aws-sdk-eventbridge 49.44% <3.79%> (-0.29%) ⬇️
serverless-aws-sdk-kinesis 58.73% <3.79%> (-0.37%) ⬇️
serverless-aws-sdk-lambda 56.91% <3.79%> (-0.36%) ⬇️
serverless-aws-sdk-s3 55.28% <3.79%> (-0.34%) ⬇️
serverless-aws-sdk-serverless-peer-service 58.99% <3.79%> (-0.38%) ⬇️
serverless-aws-sdk-sns 59.53% <3.79%> (-0.38%) ⬇️
serverless-aws-sdk-sqs 59.94% <3.79%> (-0.38%) ⬇️
serverless-aws-sdk-stepfunctions 55.11% <3.79%> (-0.35%) ⬇️
serverless-aws-sdk-util 51.11% <3.79%> (-0.36%) ⬇️
serverless-bucket-0 53.52% <3.79%> (-0.56%) ⬇️
serverless-bucket-1 58.49% <3.79%> (-0.39%) ⬇️
test-optimization-cucumber 70.92% <7.59%> (-0.24%) ⬇️
test-optimization-cypress 64.96% <7.59%> (+0.02%) ⬆️
test-optimization-jest 72.30% <7.59%> (-0.24%) ⬇️
test-optimization-mocha 71.84% <7.59%> (-0.32%) ⬇️
test-optimization-playwright-playwright-atr 59.67% <7.59%> (-0.23%) ⬇️
test-optimization-playwright-playwright-efd 59.90% <7.59%> (-0.08%) ⬇️
test-optimization-playwright-playwright-final-status 59.99% <7.59%> (-0.23%) ⬇️
test-optimization-playwright-playwright-impacted-tests 59.62% <7.59%> (+<0.01%) ⬆️
test-optimization-playwright-playwright-reporting 61.03% <7.59%> (-0.12%) ⬇️
test-optimization-playwright-playwright-test-management 60.49% <7.59%> (-0.33%) ⬇️
test-optimization-playwright-playwright-test-span 59.72% <7.59%> (-0.29%) ⬇️
test-optimization-selenium 58.90% <7.59%> (-0.38%) ⬇️
test-optimization-testopt 57.52% <3.79%> (-0.18%) ⬇️
test-optimization-vitest 73.01% <7.59%> (-0.23%) ⬇️
test-optimization-vitest-browser 58.74% <7.59%> (-0.27%) ⬇️
test-optimization-webdriverio 65.01% <3.79%> (-0.36%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pabloerhard
pabloerhard force-pushed the pabloerhard/fix-allow-list branch from 64ee21d to 9bcb63d Compare August 12, 2026 20:54
@pr-commenter

pr-commenter Bot commented Aug 13, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-08-13 15:48:58

Comparing candidate commit 481723b in PR branch pabloerhard/fix-allow-list with baseline commit f72b07e in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2317 metrics, 41 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable execution_time [-206.971ms; +209.537ms] or [-7.673%; +7.768%]

scenario:appsec-appsec-enabled-26

  • unstable execution_time [-237.870ms; +232.529ms] or [-9.160%; +8.954%]

scenario:appsec-appsec-enabled-with-attacks-24

  • unstable execution_time [-156.722ms; +166.431ms] or [-4.939%; +5.245%]

scenario:appsec-appsec-enabled-with-attacks-26

  • unstable execution_time [-190.962ms; +188.554ms] or [-6.486%; +6.405%]

scenario:appsec-control-20

  • unstable execution_time [-121.077ms; +124.111ms] or [-7.218%; +7.399%]

scenario:appsec-control-24

  • unstable execution_time [-115763.580µs; +116113.947µs] or [-9.196%; +9.224%]

scenario:appsec-control-26

  • unstable execution_time [-122.387ms; +131.971ms] or [-9.745%; +10.508%]

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-20

  • unstable execution_time [-18458.638µs; +19269.363µs] or [-7.041%; +7.351%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

  • unstable execution_time [-20.472ms; +8.668ms] or [-7.829%; +3.315%]

scenario:appsec-iast-with-vulnerability-control-20

  • unstable execution_time [-32.471ms; +38.008ms] or [-5.852%; +6.850%]

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

  • unstable execution_time [-27.031ms; +29.372ms] or [-4.938%; +5.366%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

  • unstable execution_time [-27.856ms; +35.103ms] or [-5.053%; +6.368%]

scenario:debugger-line-probe-with-snapshot-default-26

  • unstable cpu_user_time [-3.596s; +0.510s] or [-34.863%; +4.948%]
  • unstable execution_time [-3.675s; +0.552s] or [-33.242%; +4.992%]
  • unstable instructions [-32.1G instructions; +4.3G instructions] or [-37.052%; +4.944%]
  • unstable throughput [-116.956op/s; +705.698op/s] or [-3.789%; +22.865%]

scenario:debugger-line-probe-with-snapshot-minimal-24

  • unstable cpu_user_time [-651006.815µs; +650902.615µs] or [-8.177%; +8.176%]
  • unstable execution_time [-663.503ms; +636.711ms] or [-7.638%; +7.329%]
  • unstable instructions [-5902.9M instructions; +5637.2M instructions] or [-9.106%; +8.696%]
  • unstable throughput [-273.774op/s; +267.454op/s] or [-7.357%; +7.188%]

scenario:debugger-line-probe-without-snapshot-24

  • unstable cpu_user_time [-1333.877ms; +1908.125ms] or [-16.687%; +23.871%]
  • unstable execution_time [-1292.864ms; +1888.437ms] or [-14.847%; +21.687%]
  • unstable instructions [-11.3G instructions; +16.0G instructions] or [-17.349%; +24.702%]
  • unstable throughput [-608.544op/s; +440.262op/s] or [-16.306%; +11.797%]

scenario:debugger-line-probe-without-snapshot-26

  • unstable cpu_user_time [-2640.426ms; +4193.341ms] or [-27.630%; +43.880%]
  • unstable execution_time [-2633.007ms; +4225.409ms] or [-25.609%; +41.097%]
  • unstable instructions [-23.4G instructions; +37.4G instructions] or [-29.372%; +46.930%]
  • unstable max_rss_usage [-6.928MB; +14.186MB] or [-4.371%; +8.951%]
  • unstable throughput [-826.337op/s; +511.107op/s] or [-25.616%; +15.844%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-226.501ms; +407.783ms] or [-4.636%; +8.346%]
  • unstable execution_time [-224.778ms; +406.501ms] or [-4.532%; +8.197%]
  • unstable throughput [-142888.847op/s; +80211.860op/s] or [-8.448%; +4.743%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-24

  • unstable cpu_usage_percentage [-5.679%; +5.255%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-26

  • unstable cpu_user_time [-2687.089µs; +3584.947µs] or [-4.366%; +5.825%]

scenario:plugin-graphql-long-with-depth-off-20

  • unstable max_rss_usage [-3.388MB; +13.658MB] or [-2.595%; +10.458%]

scenario:plugin-graphql-long-with-depth-off-26

  • unstable max_rss_usage [-23.918MB; +33.284MB] or [-13.649%; +18.993%]

scenario:plugin-graphql-long-with-depth-on-max-20

  • unstable cpu_user_time [-586152.920µs; +584250.620µs] or [-5.090%; +5.074%]
  • unstable execution_time [-601.330ms; +593.803ms] or [-5.117%; +5.053%]
  • unstable throughput [-3.505op/s; +3.546op/s] or [-5.119%; +5.179%]

scenario:plugin-mongodb-core-plain-find-26

  • unstable execution_time [-128.035ms; +119.991ms] or [-6.096%; +5.713%]

scenario:test-optimization-large-suite-20

  • unstable max_rss_usage [-3.446MB; +8.417MB] or [-4.329%; +10.574%]

@pabloerhard
pabloerhard marked this pull request as ready for review August 13, 2026 14:15
@pabloerhard
pabloerhard requested a review from a team as a code owner August 13, 2026 14:15
@pabloerhard
pabloerhard requested review from bojbrook and removed request for a team August 13, 2026 14:15

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9bcb63d1bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/dd-trace/src/plugins/util/web.js Outdated
Comment thread packages/dd-trace/src/plugins/util/web.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 22a1e39ba3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/dd-trace/src/plugins/util/web.js Outdated
Comment thread packages/dd-trace/src/plugins/util/web.js
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant