Issue: How New Relic distributed tracing works

[linbaker]

Tell us what you need

• More in-depth breakdown of the content of a Distributed Tracing header with a focus on security

Issue was initially raised in this forum post, confirmed in the Ruby agent code that the header they are talking about is the Distributed Tracing header:

• https://discuss.newrelic.com/t/ruby-is-this-a-security-risk-newrelic-base64-header/148577

Our documentation does include a brief description of what is contained in the headers (quoted the section below):

The headers also contain information that helps us link the spans together later: metadata like the trace ID, span ID, the New Relic account ID, and sampling information.

But it does not go in-depth or discuss any security measures. I discussed this with the Distributed Tracing engineering team and they did share the internal agent spec document that goes over the anatomy of a DT payload but as far as I can find we have nothing publicly available.

Doc information (don't delete this section)

• https://docs.newrelic.com/docs/distributed-tracing/concepts/how-new-relic-distributed-tracing-works/
• OS: Mac OS 10.15.7
• Browser: Chrome 90.0.4430.212
• Device: Unknown

[bradleycamacho]

Thanks for reporting this @linbaker! This seems to be outside the scope of a quick fix. I'll create a Jira in our backlog and we'll knock this out in a sprint or two.

I can't include the Jira link in a public form, but you can find it with the ID DOC-6984.

I'll keep this issue open for now, and we'll update it once we make the edits. Thanks again!

[urbiz-nr]

Fixed in #2781.