microsoft / microsoft/ApplicationInsights-JS

[BUG] Invalid HTTP response header sent with track event

Open
#1,712 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug waiting for backend fix
Dominant language
TypeScript
Stars
685
Forks
261
Avg merge
21h 33m
Merged PRs (30d)
5

Description

**Description/Screenshot**
The App Insights `track` call sometimes returns an invalid HTTP response header that triggers a message in dev tools. I suspect this has nothing to do with this repo, but I'm not sure where to report it.

![image](https://user-images.githubusercontent.com/3195410/141005814-b40816ca-239f-4370-bf76-8ecd528d0de6.png)

`Invalid 'X-Frame-Options' header encountered when loading 'https://site.host.local/': 'allow' is not a recognized directive. The header will be ignored.`

**Steps to Reproduce**
Report an event which results in a call to the track endpoint (https://dc.services.visualstudio.com/v2/track)

- OS/Browser: Edge (Chromium)
- SDK Version [e.g. 22]:
- How you initialized the SDK:

**Expected behavior**
All HTTP response headers should be valid across browsers

`X-Frame-Options` only allows `DENY` or `SAMEORIGIN` (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)

**Additional context**
Seen in Edge (Chromium) only so far. The header is completely missing in Chrome and Firefox (all current versions)

**Firefox**
![image](https://user-images.githubusercontent.com/3195410/141007344-44652dfc-15ca-4dbb-9120-379d55295040.png)

**Chrome**
![image](https://user-images.githubusercontent.com/3195410/141007439-58b40386-9e9a-4edc-b1a6-f567a3d21337.png)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report points to the track endpoint, https://dc.services.visualstudio.com/v2/track, rather than a repository file or test. Start by verifying its response headers in Edge and comparing Chrome and Firefox; the issue is complete when ownership of the invalid header and a reproducible result are established.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, typescript
Domain
api, observability
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.