Skip to content

feat(appsec): support transaction id header for request tracing#4124

Merged
LaurenceJJones merged 1 commit into
crowdsecurity:masterfrom
LaurenceJJones:feature/crowdsec-transaction-id
Dec 10, 2025
Merged

feat(appsec): support transaction id header for request tracing#4124
LaurenceJJones merged 1 commit into
crowdsecurity:masterfrom
LaurenceJJones:feature/crowdsec-transaction-id

Conversation

@LaurenceJJones
Copy link
Copy Markdown
Contributor

@LaurenceJJones LaurenceJJones commented Dec 10, 2025

fix #3997

Allow incoming HTTP requests to provide a custom transaction ID via X-Crowdsec-Appsec-Transaction-Id header. This ID will be used for both inband and outband processing, enabling consistent request tracing across web server logs and CrowdSec logs.

  • Extract transaction ID from X-Crowdsec-Appsec-Transaction-Id header if present
  • Fall back to generating UUID if header is not provided (backward compatible)
  • Remove header before passing to Coraza (consistent with other special headers)
  • Same transaction ID used for both inband and outband Coraza transactions

@github-actions
Copy link
Copy Markdown

@LaurenceJJones: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

  • /kind feature
  • /kind enhancement
  • /kind refactoring
  • /kind fix
  • /kind chore
  • /kind dependencies
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@github-actions
Copy link
Copy Markdown

@LaurenceJJones: There are no area labels on this PR. You can add as many areas as you see fit.

  • /area agent
  • /area local-api
  • /area cscli
  • /area appsec
  • /area security
  • /area configuration
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

…acing

Allow incoming HTTP requests to provide a custom transaction ID via
X-Crowdsec-Transaction-Id header. This ID will be used for both inband
and outband processing, enabling consistent request tracing across web
server logs and CrowdSec logs.

- Extract transaction ID from X-Crowdsec-Transaction-Id header if present
- Fall back to generating UUID if header is not provided (backward compatible)
- Remove header before passing to Coraza (consistent with other special headers)
- Same transaction ID used for both inband and outband Coraza transactions
@LaurenceJJones LaurenceJJones force-pushed the feature/crowdsec-transaction-id branch from dda176c to 647466b Compare December 10, 2025 12:31
@LaurenceJJones
Copy link
Copy Markdown
Contributor Author

/kind enhancement
/area appsec

@LaurenceJJones LaurenceJJones changed the title feat(appsec): support X-Crowdsec-Transaction-Id header for request tr… feat(appsec): support transaction id header for request tracing Dec 10, 2025
@codecov
Copy link
Copy Markdown

codecov Bot commented Dec 10, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.85%. Comparing base (db3efdb) to head (647466b).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4124      +/-   ##
==========================================
- Coverage   62.87%   62.85%   -0.03%     
==========================================
  Files         464      464              
  Lines       33286    33290       +4     
==========================================
- Hits        20929    20924       -5     
- Misses      10237    10243       +6     
- Partials     2120     2123       +3     
Flag Coverage Δ
bats 46.21% <100.00%> (+0.01%) ⬆️
unit-linux 35.58% <0.00%> (-0.11%) ⬇️
unit-windows 25.04% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@LaurenceJJones LaurenceJJones added this to the 1.7.5 milestone Dec 10, 2025
@LaurenceJJones LaurenceJJones merged commit 874cf66 into crowdsecurity:master Dec 10, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/appsec kind/enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

appsec: Allow remediation to pass request ID to tie to Transaction ID

2 participants