Skip to content

Opt-out API Security endpoint discovery #9623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 3, 2025
Merged

Opt-out API Security endpoint discovery #9623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec98881
opt-out API Security endpoint discovery
jandro996 Sep 26, 2025
2a14d7a
fix AppSecDispatcherServlet Instrumentations
jandro996 Sep 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions .../java/datadog/trace/instrumentation/springweb/AppSecDispatcherServletInstrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import datadog.trace.agent.tooling.InstrumenterModule;
import datadog.trace.api.Config;
import datadog.trace.api.telemetry.EndpointCollector;
import java.util.HashMap;
import java.util.Map;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.matcher.ElementMatcher;
Expand Down Expand Up @@ -71,13 +72,16 @@ public static class AppSecHandlerMappingAdvice {

@Advice.OnMethodExit(suppress = Throwable.class)
public static void afterRefresh(@Advice.Argument(0) final ApplicationContext springCtx) {
final RequestMappingHandlerMapping handler =
springCtx.getBean(RequestMappingHandlerMapping.class);
if (handler == null) {
final Map<String, RequestMappingHandlerMapping> handlers =
springCtx.getBeansOfType(RequestMappingHandlerMapping.class);
if (handlers == null || handlers.isEmpty()) {
return;
}
final Map<RequestMappingInfo, HandlerMethod> mappings = handler.getHandlerMethods();
if (mappings == null || mappings.isEmpty()) {
final Map<RequestMappingInfo, HandlerMethod> mappings = new HashMap<>();
for (RequestMappingHandlerMapping mapping : handlers.values()) {
mappings.putAll(mapping.getHandlerMethods());
}
if (mappings.isEmpty()) {
return;
}
EndpointCollector.get().supplier(new RequestMappingInfoIterator(mappings));
Expand Down
14 changes: 9 additions & 5 deletions ...ace/instrumentation/springweb/AppSecDispatcherServletWithPathPatternsInstrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
import datadog.trace.agent.tooling.InstrumenterModule;
import datadog.trace.api.Config;
import datadog.trace.api.telemetry.EndpointCollector;
import java.util.HashMap;
import java.util.Map;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.matcher.ElementMatcher;
Expand Down Expand Up @@ -66,13 +67,16 @@ public static class AppSecHandlerMappingAdvice {

@Advice.OnMethodExit(suppress = Throwable.class)
public static void afterRefresh(@Advice.Argument(0) final ApplicationContext springCtx) {
final RequestMappingHandlerMapping handler =
springCtx.getBean(RequestMappingHandlerMapping.class);
if (handler == null) {
final Map<String, RequestMappingHandlerMapping> handlers =
springCtx.getBeansOfType(RequestMappingHandlerMapping.class);
if (handlers == null || handlers.isEmpty()) {
return;
}
final Map<RequestMappingInfo, HandlerMethod> mappings = handler.getHandlerMethods();
if (mappings == null || mappings.isEmpty()) {
final Map<RequestMappingInfo, HandlerMethod> mappings = new HashMap<>();
for (RequestMappingHandlerMapping mapping : handlers.values()) {
mappings.putAll(mapping.getHandlerMethods());
}
if (mappings.isEmpty()) {
return;
}
EndpointCollector.get().supplier(new RequestMappingInfoWithPathPatternsIterator(mappings));
Expand Down
3 changes: 1 addition & 2 deletions dd-trace-api/src/main/java/datadog/trace/api/ConfigDefaults.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,7 @@ public final class ConfigDefaults {
static final int DEFAULT_APPSEC_WAF_TIMEOUT = 100000; // 0.1 s
static final boolean DEFAULT_API_SECURITY_ENABLED = true;
static final float DEFAULT_API_SECURITY_SAMPLE_DELAY = 30.0f;
// TODO: change to true once the RFC is approved
static final boolean DEFAULT_API_SECURITY_ENDPOINT_COLLECTION_ENABLED = false;
static final boolean DEFAULT_API_SECURITY_ENDPOINT_COLLECTION_ENABLED = true;
static final int DEFAULT_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT = 300;
static final boolean DEFAULT_APPSEC_RASP_ENABLED = true;
static final boolean DEFAULT_APPSEC_STACK_TRACE_ENABLED = true;
Expand Down