Smart Tracing Context Injection for CORS-Limited External Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional tracer applications struggle to capture accurate telemetry data across servers, platforms, or threads in advanced web-based applications, requiring manual instrumentation and vendor-specific configurations, and often fail to obtain telemetry from remote servers due to security restrictions.
Innovation Solution
A method for automatically instrumenting enterprise applications with telemetry capabilities, enabling cross-thread and cross-server telemetry by detecting events and calls, and injecting tracing headers into requests, while prioritizing spans to manage network congestion and handle security restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If tracing headers are injected into requests to external servers, then telemetry data collection is improved, but security restrictions and CORS policies may block the requests
Solution Approach 1:
The system performs preliminary actions by maintaining allow lists and deny lists of external servers before making tracing requests. The web browser checks these lists beforehand to determine whether tracing headers should be injected into requests to specific external servers, preventing security issues before they occur.
Solution Approach 2:
The system uses feedback mechanisms by interrogating external servers to determine whether they allow tracing headers, then updating the allow list or deny list based on the server's response. This feedback loop enables the system to adapt to security restrictions dynamically while maintaining telemetry capabilities where permitted.
2Measurement precision
If manual instrumentation is used to capture telemetry data, then measurement accuracy is improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The system enables self-service by automatically instrumenting enterprise applications with telemetry capabilities without requiring manual intervention. The web browser automatically detects events and calls, injects tracing headers into requests, and manages span prioritization, eliminating the need for developers to manually add instrumentation code.
Solution Approach 2:
The system achieves universality by creating a multi-functional web browser component that handles multiple telemetry tasks: detecting events and calls, injecting tracing headers, managing allow lists and deny lists, interrogating external servers, and prioritizing spans. This single component replaces multiple manual instrumentation steps.
3Loss of information
If all spans are captured and transmitted, then telemetry completeness is improved, but network congestion and loss of energy increase
Solution Approach 1:
The system applies partial action by prioritizing spans based on importance and transmitting only the most critical telemetry data when network conditions are constrained. The web browser ranks spans and selectively transmits high-priority spans first, ensuring essential telemetry information is captured while reducing overall network traffic.
4Loss of information
If tracing headers are injected into all requests, then telemetry coverage is improved, but ease of operation and security compliance worsen
Solution Approach 1:
The system segments the request management process by separating requests into different categories based on external server trust levels. Requests to servers on the allow list receive tracing headers, requests to servers on the deny list do not receive tracing headers, and requests to servers not on either list undergo interrogation. This segmentation simplifies decision-making for each request type.
Data Source
AI summary
Disclosed systems relate to propagating tracing across a distributed software application. In an example, an application logs tracing data for a web page from an original server. The application determines, at the web browser, that the web page from the original server requires a request to an external server outside a domain of the original server. The application interrogates the external server to determine whether the external server allows tracing headers in requests. The application updates an allow list, at the web browser, to indicate that the external server allows tracing headers in requests from the original server. The application injects a tracing header in the request based on a result of the interrogation. The application sends, from the web browser to the external server, the request with the tracing header. The external server is configured to log tracing data based on the tracing header.