How do I enable Ajax Whitelisting?

Headers and Bodies

FullStory Dev Tools gives you the power to record Request Headers, Response Headers, Request Bodies and Response Bodies for individual Network Requests that took place within a user's recorded session. 

Request/Response Headers

Request and Response Headers are HTTP Headers that include context about about requests and may include details such as Accept, Cookie, Cache-control, Server, Date and other helpful metadata for understanding the conditions of a request. 

When Request/Response Headers are available, FullStory will only record header fields that are known to be safe and make those available to view under Network Request details. For any Request/Response Header fields that aren't clearly known to be safe for recording, FullStory will not record those details and they will be shown as [redacted] when you view Network Details.

Note: at this time, FullStory doesn't offer controls for whitelisting specific Request/Response Headers data.

Request/Response Bodies

Request and Response Bodies are the content messages or payloads sent back and forth during a request.

Some of the details in Request and Response Bodies can be super powerful for debugging. However, because these bodies often carry submitted form data, these bodies are likely to contain some sensitive information that FullStory would never want to capture.

Unlike some other recording tools that pull in Request/Response Headers and Bodies by default (often bringing toxic personal data with them), FullStory gives you the ability to whitelist only the specific parts of the Request/Response Bodies that you know are safe to record and that will be useful for your own debugging process. 

Whitelisting the Request/Response Bodies

To get started with whitelisting, first you will need to enable Ajax Recording under Settings > Recording. 

It's important to note—enabling this Recording Option alone will not immediately result in any effect. For security reasons, you'll need to explicitly whitelist individual Request/Response bodies.

Next:

Identify the request that you'd like to begin recording Request and/or Response Bodies. Take a moment to consider—do you want to record the entire bodies? Or, only specific fields?

Remember: if the body could contain any sensitive information, you will want to identify specific fields to whitelist and not record the whole body.

Make note of both the URL path and the names of the fields you'd like to whitelist, if applicable.

Then, log into FullStory and:

1. Navigate to Settings > Privacy. Scroll down until you find the section labeled "Ajax Request Whitelist."
2. Click "Add URL Pattern" to add a new whitelisted request.
3. Enter the request URL path you'd like to whitelist as a regex pattern. For example, if your request URL is  https://www.example.com/api/[cust-id]/login then you should enter a URL pattern that looks like .*www\.example\.com/api/.*/login.
4. Use the radio buttons to select whether you'd like to record the full body or only specific fields.
5. If defining specific fields, enter a list of the fields you'd like to whitelist with each field on a new line.
6. Click 'Save whitelisted request' to begin recording Request/Response bodies from that URL pattern.

Syntax & Semantics

URL Patterns

• Regular expression, matching against a full URL
• E.g., .*www\.example\.com/api/.*/login

Request/Response Bodies Fields

• whitelist => element(/element)*
• element =>
  • fieldName (match a specific field by name)
  • * (match any field)
  • ** (match any number of fields, including children)
• E.g., foo/bar,  foo/bar/*/baz,  foo/**

Example

Let's look at a simple login request.

URL

For example, if the login URL is:

https://www.example.com/api/[cust-id]/login

with the following requests and responses:

Request

{ 
creds: { 
user: “foo@customer.com”, 
password: “s3kr1t!” 
} 
} 

Response

{ 
success: false, 
error: { 
msg: “something went wrong” 
} 
} 

Then, to whitelist only the fields user, success, error, and msg but not password, your whitelisted request in FullStory would require these settings:

URL Pattern

.*www.example.com/api/.*/login

Request bodies - Specific fields

creds/user

Response bodies - Specific fields

success
error/msg

After these settings are configured, whenever you view Responses and Requests within the Network Tab in FullStory, you'd expect to see the user credentials, success, and error message come through while the password would remain redacted.

Editing or Removing Ajax Request Whitelists

After a whitelisted request has been saved, it can be edited, disabled, or removed at any time. 

Under Settings > Privacy > Ajax Request Whitelist, you can click on any configured whitelist in the table to open the settings to modify the whitelisted request.

To disable a whitelisted request but keep the URL pattern configuration, use the radio buttons to set the whitelisted request to record "Nothing."

To remove the whitelisted request completely, click to modify the whitelisted request and then click "Remove whitelisted request."