PostHog / PostHog/posthog

Unable to create heatmaps while targeting internal/local host

Open
#45,699 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
39.9k
Forks
3.4k
Avg merge
6h 51m
Merged PRs (30d)
232

Description

Bug Description

In self-hosted version of Posthog there is a problem with heatmaps generation when target site is hosted on internal/private host.
I've found in source code that there is a call to block internal urls on heatmap creation process - https://github.com/PostHog/posthog/blob/300288a4e42036bb454355f6d4cc776683ee923e/posthog/tasks/heatmap_screenshot.py#L276
which may be necessary for cloud-based solution, but not in self-hosted.
The goal of self-hosted solutions is also to host them inside your own domain, maybe without internet access for security reasons.

How to reproduce

  1. Connect self-hosted Posthog with site in local/internal domain
  2. Open Posthog, navigate to 'Heatmaps'
  3. Press 'New heatmap' button, then select site from step 1
  4. Press 'Save'
Debug info
- [ ] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [x] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in posthog/tasks/heatmap_screenshot.py around line 276 and trace how internal URLs are blocked during heatmap creation. Compare the behavior needed for self-hosted installations with the existing protection, then reproduce the reported flow using an internal target; done means self-hosted heatmap creation works for that target without breaking the relevant URL safeguards.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
analytics, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.