[GitHub] [skywalking] warrmr commented on issue #8877: [Bug] skywalking-client-js not sending errors to OAP server

[GitBox <gi...@apache.org>]

warrmr commented on issue #8877:
URL: https://github.com/apache/skywalking/issues/8877#issuecomment-1101870619

   > From my perspective, your server don't allow you to customize parameter in the http header and you should resolve this problem.
   
   > @Fine0830 I think this may be caused by 3rd party SAAS services, like Google's, they put some rules about this for security, and out of users' control. From SkyWalking perspective, we should expose some APIs to set URL whitelist which could not be traced(no header injection, and only span sending out or not). WDYT?
   
   You are both correct, Google doesn't allow the modification of the headers for security and I have since found out that the skywalking-client-js adds a sw8 header to the outbound requests with a trace ID and segment ID adding this to the register call worked :) `noTraceOrigins: [/.*googleapis.*/, /.*firebaseapp.*/],` Thankyou. 
   
   @wu-sheng May I change this from a [BUG] to a [FEATURE] request please as my problems seem to be more me not understanding some of the properties in the register function and not knowing I needed to call that. 
   
   @Fine0830 I am not sure if this is possible but somewhere in the xhr.ts read event.details.requestHeaders("X-Content-Type-Options") and if it matches "nosniff" then don't modify the header and do the same as you do with `noTraceOrigins` ? I am happy to run a test version for you if that would help. 
   
   https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
   
   Thanks Again guys I really appreciate the helps. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org