You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
RUM config from a broker's JSON can make every app request throw #22
UwtRumAppMonitorConfig usually comes from a credentials broker as JSON, and the README and DESIGN examples pass that config straight to the sink. JSON can't carry a RegExp or a function, but aws-rum-web expects them in several places and uses them without checking:
urlsToInclude / urlsToExclude (inside the http telemetry): the SDK's patched fetch and XMLHttpRequest.open call pattern.test(url) on each entry before the real request. With ["http", { "urlsToExclude": ["/health"] }], every request the app makes throws TypeError: urlPattern.test is not a function.
addXRayTraceIdHeader: ["…"]: the same failure, on every traced request. X-Ray is on by default.
pagesToInclude / pagesToExclude: tested on every recorded event and inside the SDK's history.pushState wrapper, so a string breaks the app's router navigation.
ignore (errors, performance) and interactionId (interaction): called as functions inside the SDK's listeners.
telemetries is typed (string | (string | object)[])[], so nothing catches this at compile time. It also breaks DESIGN.md's "telemetry never breaks the application" rule: the throw happens inside the SDK, outside every guard the library has.
Expected
The sink checks these settings before loading the SDK. If any holds a value of the wrong type, RUM doesn't start for the page (as with a broker returning null), so the app keeps working and nothing the filters should exclude is recorded.
A console warning in every environment names each bad setting and the type it expects, never its value.
Valid RegExps, functions and booleans pass through unchanged; a setting explicitly undefined counts as unset.
Also
Doc examples with related problems:
Log backend: the examples send every record with keepalive: true. Browsers reject keepalive requests once all in flight exceed 64 KiB, and the .catch hides it, so a burst of records is lost silently.
Batching: the example ignores sendBeacon's false return, which hits the same limit.
Fragments: the channel lookup reads window.top, which misses a shell that is itself framed by another app.
Activity