Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Using App Insights connection string leads to double slash #2163

Closed
vincent-fortum opened this issue Sep 25, 2023 · 3 comments
Closed
Assignees
Milestone

Comments

@vincent-fortum
Copy link

Description/Screenshot

When using an Application Insights connection string, the tracking url contains a double forward slash. This is an issue because it conflicts with our CSP headers:

Screenshot 2023-09-25 at 12 47 19

Content-Security-Policy: The page’s settings blocked the loading of a resource at https://westeurope-5.in.applicationinsights.azure.com//v2/track (“connect-src”).

Of course we can whitelist the url with the double forward slash but I think this should rather be fixed at the source.

Steps to Reproduce

  • OS/Browser: MacOS / Firefox 117.0 (shouldn't matter)
  • SDK Version [e.g. 22]: @microsoft/applicationinsights-web 2.8.9
  • How you initialized the SDK:
AI_CONNECTION_STRING=$(az monitor app-insights component show --resource-group $RG --app $AI --query connectionString)
# connection string contains IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/
new ApplicationInsights({
  config: {
    connectionString: process.env.AI_CONNECTION_STRING,
    enableAutoRouteTracking: true,
    extensions: [new ReactPlugin()],
  },
})

Expected behavior

Requests are made with a single forward slash

- https://westeurope-5.in.applicationinsights.azure.com//v2/track
+ https://westeurope-5.in.applicationinsights.azure.com/v2/track

Additional context

@MSNev MSNev added the investigation required Further investigation or discussions required label Sep 25, 2023
@MSNev
Copy link
Collaborator

MSNev commented Sep 25, 2023

@siyuniu-ms this seems vaguely familiar can you please check if this has been addressed in later v2.x and v3.x releases and if not we will schedule work to sanitize the inbound connection string.

@siyuniu-ms
Copy link
Contributor

The problem could be reproduced in current v3.x. A task is made to fix this bug.

@siyuniu-ms siyuniu-ms added fixed - waiting release PR Committed and waiting deployment and removed investigation required Further investigation or discussions required labels Oct 17, 2023
@MSNev
Copy link
Collaborator

MSNev commented Oct 31, 2023

Fixed and released with v3.0.4, waiting for backporting to 2.8.x

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants