Unable to create heatmaps while targeting internal/local host
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 39.9k
- Forks
- 3.4k
- Avg merge
- 6h 51m
- Merged PRs (30d)
- 232
Description
Bug Description
In self-hosted version of Posthog there is a problem with heatmaps generation when target site is hosted on internal/private host.
I've found in source code that there is a call to block internal urls on heatmap creation process - https://github.com/PostHog/posthog/blob/300288a4e42036bb454355f6d4cc776683ee923e/posthog/tasks/heatmap_screenshot.py#L276
which may be necessary for cloud-based solution, but not in self-hosted.
The goal of self-hosted solutions is also to host them inside your own domain, maybe without internet access for security reasons.
How to reproduce
- Connect self-hosted Posthog with site in local/internal domain
- Open Posthog, navigate to 'Heatmaps'
- Press 'New heatmap' button, then select site from step 1
- Press 'Save'
Debug info
- [ ] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [x] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in posthog/tasks/heatmap_screenshot.py around line 276 and trace how internal URLs are blocked during heatmap creation. Compare the behavior needed for self-hosted installations with the existing protection, then reproduce the reported flow using an internal target; done means self-hosted heatmap creation works for that target without breaking the relevant URL safeguards.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- analytics, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100