How do I enable Ajax Allowlisting?

Headers and Bodies

FullStory Dev Tools gives you the power to record Request Headers, Response Headers, Request Bodies and Response Bodies for individual Network Requests that took place within a user's recorded session. 

Request/Response Headers

Request and Response Headers are HTTP Headers that include context about requests and may include details such as Accept, Cookie, Cache-control, Server, Date and other helpful metadata for understanding the conditions of a request. 

When Request/Response Headers are available, FullStory will only record header fields that are known to be safe and make those available to view under Network Request details. For any Request/Response Header fields that aren't clearly known to be safe for recording, FullStory will not record those details and they will be shown as [redacted] when you view Network Details.

Note: at this time, FullStory doesn't offer controls for allowlisting specific Request/Response Headers data.

Request/Response Bodies

Request and Response Bodies are the content messages or payloads sent back and forth during a request.

Some of the details in Request and Response Bodies can be super powerful for debugging. However, because these bodies often carry submitted form data, these bodies are likely to contain some sensitive information that FullStory would never want to capture.

Unlike some other recording tools that pull in Request/Response Headers and Bodies by default (often bringing sensitive personal data with them), FullStory gives you the ability to allowlist only the specific parts of the Request/Response Bodies that you know are safe to record and that will be useful for your own debugging process. 

Allowlisting the Request/Response Bodies

To get started with allowlisting, first you will need to enable Ajax Recording under Settings > Recording. 

It's important to note—enabling this Recording Option alone will only result in:

• Methods
• Safe headers
• Allowlisted Request/Response bodies (if configured)
• Request/Response size (for same-origin requests)

For security reasons, you'll need to explicitly allowlist individual Request/Response bodies for more details to display in Dev Tools.

In the case where Ajax Recording is disabled, and you're allowlisting individual Request/Response bodies in your Privacy settings, it will not immediately result in any effect.

Next: Identify the request that you'd like to begin recording Request and/or Response Bodies. Take a moment to consider—do you want to record the entire bodies? Or, only specific fields?

Remember: If the body could contain any sensitive information, you will want to identify specific fields to allowlist and not record the whole body.

Make note of both the URL path and the names of the fields you'd like to allowlist, if applicable.

Then, log into FullStory and:

1. Navigate to Settings > Privacy. Scroll down until you find the section labeled "Ajax Request Allowlist."
2. Click "Add URL Pattern" to add a new allowlisted request.
3. Enter the request URL path you'd like to allowlist as a regex pattern. For example, if your request URL is  https://www.example.com/api/[cust-id]/login then you should enter a URL pattern that looks like .*www\.example\.com/api/.*/login.
4. Use the radio buttons to select whether you'd like to record the full body or only specific fields.
5. If defining specific fields, enter a list of the fields you'd like to allowlist with each field on a new line.
6. Click 'Save allowlisted request' to begin recording Request/Response bodies from that URL pattern.

Syntax & Semantics

URL Patterns

• Regular expression, matching against a full URL
• E.g., .*www\.example\.com/api/.*/login
• (note: FullStory uses Golang's regex syntax which permits unescaped / )

Request/Response Bodies Fields

• allowlist => element(/element)*
• element =>
  • fieldName (match a specific field by name)
  • * (match any field)
  • ** (match any number of fields, including children)
• E.g., foo/bar,  foo/bar/*/baz,  foo/**

Example

Let's look at a simple login request.

URL

For example, if the login URL is:

https://www.example.com/api/[cust-id]/login

with the following requests and responses:

Request

{ 
creds: { 
user: “foo@customer.com”, 
password: “s3kr1t!” 
} 
} 

Response

{ 
success: false, 
error: { 
msg: “something went wrong” 
} 
} 

Then, to allowlist only the fields user, success, error, and msg but not password, your allowlisted request in FullStory would require these settings:

URL Pattern

.*www.example.com/api/.*/login

Request bodies - Specific fields

creds/user

Response bodies - Specific fields

success
error/msg

After these settings are configured, whenever you view Responses and Requests within the Network Tab in FullStory, you'd expect to see the user credentials, success, and error message come through while the password would remain redacted.

Editing or Removing Ajax Request Allowlists

After an allowlisted request has been saved, it can be edited, disabled, or removed at any time. 

Under Settings > Privacy > Ajax Request Allowlist, you can click on any configured allowlist in the table to open the settings to modify the allowlisted request.

To disable an allowlisted request but keep the URL pattern configuration, use the radio buttons to set the allowlisted request to record "Nothing."

To remove the allowlisted request completely, click to modify the allowlisted request and then click "Remove allowlisted request."