fix(appsec): send the normalized status code on end-invocation - #817
Merged
CarlesDD merged 8 commits intoAug 31, 2026
Merged
Conversation
| endInvocationChannel.publish({ | ||
| span, | ||
| statusCode: result?.statusCode?.toString(), | ||
| statusCode: statusCode ?? result?.statusCode?.toString(), |
Contributor
There was a problem hiding this comment.
is it possible that statusCode has different value from results.statusCode, assuming neither is null?
Collaborator
Author
There was a problem hiding this comment.
only for non-http triggers, but the tracer drops those end-invocation messages away, so it was dead code. removed.
litianningdatadog
left a comment
litianningdatadog
left a comment
Contributor
There was a problem hiding this comment.
left some comment
CarlesDD
commented
Aug 28, 2026
| for (const [key, value] of Object.entries(headers)) { | ||
| const lowerKey = key.toLowerCase(); | ||
| if (!(lowerKey in result) && value !== undefined) { | ||
| result[lowerKey] = value; |
Contributor
There was a problem hiding this comment.
if we plan to keep this normalizeHeaders() generic, you may want to expand header value to support input type such as number and bool and stringfy in result?
litianningdatadog
approved these changes
Aug 28, 2026
litianningdatadog
left a comment
litianningdatadog
left a comment
Contributor
There was a problem hiding this comment.
Stamped. Left a non-blocker comment
CarlesDD
deleted the
ccapell/APPSEC-68818/fix-appsec-end-invocation-status-code
branch
August 31, 2026 13:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Two fixes on the AppSec end-invocation payload:
onEndingInvocationso the HTTP status code is resolved and tagged before AppSec runs, and publishes that normalized value.Motivation
AppSec was publishing the raw
result.statusCodeand raw response headers, so the WAF got no status at all when the handler omitted one and response headers in a different shape from the request ones.APPSEC-68818
Testing Guidelines
src/appsec/index.spec.tscovers the normalized value winning over the raw one and the fallback for non-HTTP triggers.src/trace/listener.spec.tsadds cases over real event samples: API Gateway v2 without a status, ALB with no result, streaming with no result, the tag-before-AppSec ordering, and a 500 still reaching AppSec while short-circuiting.src/appsec+src/trace: 475 tests passing.tsc,tslintandprettierclean.Additional Notes
Shippable on its own: it fixes the status code the WAF receives today, with or without API Security. It is also a prerequisite for API Security on Lambda, where the sampling decision is taken off the span and needs
http.status_codealready set.Types of Changes
Check all that apply