Configure AjaxRequest events

In agent version 1211 or higher, all network requests made by a page are recorded as AjaxRequest events. You can configure which requests are recorded and what data is captured:

• Deny list: Filter which domains and URLs are excluded from AJAX tracking
• Payload capture: Record full request and response data for debugging failures

Deny list

By default, we record AjaxRequest events for all network requests made by your application.

• To stop recording all events, add a singular * (asterisk) wildcard character.
  • Example: *
• To stop recording events for a full site, add the domain name.
  • Example: mywebsite.com
• To stop recording events for a specific page, add the domain and path.
  • Example: mywebsite.com/photos
• Starting with agent version 1.307.0, anywhere we find an * (asterisk), we’ll match any length of string.
  • Example: mywebsite.com/shop/* (for a path), *.mywebsite.com (for a subdomain), mywebsite.com/*/shop/*/checkout (for mid-URL strings).

The protocol, port, search, and hash of a URL are ignored by the deny list.

Access the deny list

To update the deny list of URLs your application will filter from creating events, go to the app settings page:

1. Go to one.newrelic.com > All capabilities > Browser > (select an app) > Settings > Application settings.
2. Under the AJAX data capture settings section, in the Deny list field, add the filters you would like to apply to your app.
3. Select Save to update the agent configuration.
4. Redeploy the browser agent (either restarting the associated APM agent or updating the copy/paste browser installation).

Validate deny list filters

To validate whether the filters you have added work as expected, run a NRQL query for AjaxRequest events matching your filter.

FROM AjaxRequest SELECT * WHERE requestUrl LIKE '%example.com%'

Payload capture data

You can enable payload capture for all requests or only for failed requests. When enabled, the browser agent captures the request and response payloads for all AJAX calls for all the allowed domains. This is useful for debugging failures that aren't visible from metadata alone, such as errors hidden in response bodies.

When you enable AJAX payload capture, the browser agent adds the following attributes to AjaxRequest events:

• requestBody: The request payload.

• requestHeaders: Request headers as JSON.

• requestQuery: URL query parameters as JSON.

• responseBody: The response payload.

• responseHeaders: Response headers as JSON.

• ajaxRequest.id: Unique identifier for each AJAX request.

  All payload data attributes are truncated at 4096 bytes. When truncation occurs, the last 4 bytes are replaced with ... to indicate that the content was cut off.

Enable payload capture

You can enable payload capture using one of the following methods:

window.NREUM.init = {
    ...<other init properties>...,
    ajax: {
      deny_list: ["bam.nr-data.net"],
      capture_payloads: 'failures' // or 'none', 'all'
    }
}

import { BrowserAgent } from '@newrelic/browser-agent/loaders/browser-agent'

const options = {
  init: {
    ...<other init properties>...,
    ajax: {
      deny_list: ["bam.nr-data.net"],
      capture_payloads: 'failures' // or 'none', 'all'
    }
  },
  info: { ... },
  loader_config: { ... }
}

new BrowserAgent(options)

When you enable payload capture for the first time, New Relic automatically adds baseline obfuscation rules to protect common sensitive data:

• Credit card numbers: Detects and masks major credit card formats (Visa, MasterCard, American Express, Discover, etc.)
• Social Security numbers: Detects and masks SSN patterns

You can configure obfuscation rules in the New Relic platform to mask sensitive data before it's sent to New Relic. For more details on obfuscation rules, see Obfuscate browser agent data.

After you enable the payload capture setting, you can view the captured payload data at the following pages:

• AJAX request details
• Page view
• Session replay

How payload capture interacts with the deny list

Payload capture respects your existing deny list. For any AJAX request:

• If the URL is on the deny list, the event is dropped entirely and no metadata or payload is captured.
• If the URL isn't on the deny list, based on your capture payload settings, the agent captures the request and response payloads and applies obfuscation rules before sending the data to New Relic.

Related documentation