Writekey displayed in Segment data object

[sandarsh-sridhar-cliq]

When using 'track' or 'identify', write key is also displayed in the segment event data.
Is there a specific reason for this?
I understand that write key is required to make an authentication token while posting to Segment API endpoint. But it only needs to be in the http-client headers. Or is there something I am missing here?

[f2prateek]

hey @sandarsh-sridhar-cliq the library sends the data as an authorization header (

Analytics.NET/Analytics/Request/BlockingRequestHandler.cs

Line 138 in 8d0b148

_httpClient.Headers.Add("Authorization", "Basic " + BasicAuthHeader(batch.WriteKey, string.Empty));

). I believe it's the API and debugger that maybe show this in the body - I might suggest you write in via our support form so our support team can get the right team to answer this!

[sandarsh-sridhar-cliq]

Thank you for responding to the issue this quickly. I had gone through that snippet of code. It absolutely makes sense to have the write key in a strongly typed class. But that property can be ignored during serialization with JsonIgnore property from Newtonsoft.json, so that it doesn't make it to the event data itself.

[f2prateek]

Ah... I see what you mean. It's because we convert the batch object to JSON directly here

Analytics.NET/Analytics/Request/BlockingRequestHandler.cs

Line 133 in 8d0b148

string json = JsonConvert.SerializeObject(batch);

, causing the writeKey to be sent.

[sandarsh-sridhar-cliq]

That's correct. So, when you annotate the WriteKey property with JsonIgnore, it wouldn't make it to the payload but you will still be able to make the POST request.

[f2prateek]

Cool - I've opened a ticket internally to track this. We'll post here when there's an update!

[sandarsh-sridhar-cliq]

Thank you. I appreciate it. :)

[f2prateek]

I was doing some testing, and it looks like the writeKey is copied to the body, even if you only send it in the header.

Here's an example:

curl -X "POST" "https://api.segment.io/v1/import" \
     -H 'Content-Type: application/json; charset=utf-8' \
     -u '{writeKey}:' \
     -d $'{
  "batch": [
    {
      "type": "track",
      "userId": "prateek",
      "event": "Button Clicked"
    }
  ]
}'

So even if we made a fix here, it wouldn't actually fix the underlying issue. I'd recommend opening a support issue - so they can route this to the right folks and notify you if there is an update. I'll ping the team about this directly as well!

[sandarsh-sridhar-cliq]

Hmm...That's interesting. Well, thank you for trying though. Yeah, I shall open a support issue.
Thanks again.

[nd4p90x]

Confirmed that the writeKey is not being displayed in the current version, Thank you.