Infrastructure pass-through requirements for RUM

Dynatrace Classic
Reference
9-min read

Real User Monitoring (RUM) operates within an HTTP ecosystem and relies on a set of requests, headers, and cookies to capture and report real user data, and to link it with backend distributed traces. For RUM to work as expected, your infrastructure—including firewalls, proxies, load balancers, content delivery networks, web servers, and any other components in the request path—must allow these requests, headers, and cookies to pass through unaltered. In addition, OneAgent uses the headers described in Span and trace context propagation in Distributed Traces Classic for distributed tracing, which also need to pass through your infrastructure.

Web applications

Requests

On web applications, the RUM JavaScript is either injected automatically or inserted manually into webpages. The RUM monitoring code is loaded as an external file unless you use the snippet format inline code—and even then, the Session Replay monitoring code is loaded as a separate file. Once active, the RUM JavaScript starts sending beacon requests to report the captured RUM data.

For RUM to function fully, both requests for the RUM monitoring code and RUM beacons must pass through your infrastructure.

Requests for the RUM monitoring code

For agentless monitoring, requests are sent to the Dynatrace CDN with a URL that contains the string js-cdn.dynatrace.com/jstag/.
For auto-injection, requests are, by default, sent to the web or app server that hosts the application, and the URL path contains the string ruxitagentjs_.

For details on the default URL and the available configuration options, see Configure the Real User Monitoring code source.

RUM beacons

RUM beacons report the data captured by the RUM JavaScript back to a beacon endpoint.

For agentless monitoring, beacons are, by default, sent to a beacon endpoint with the URL path /bf that is part of a Cluster ActiveGatein the Dynatrace SaaS infrastructure.
For auto-injection, beacons are, by default, sent to the web or app server that hosts the application, and the URL path ends with /rb_<id>.
The beacon URL includes a query string that must not be altered—this includes modifying, removing, or reordering parameters.
The POST body contains the payload, sent with the text/plain content type. For Session Replay, the application/octet-stream content type can also be used.
For Session Replay, POST requests may be preceded by CORS preflight requests, which are OPTIONS requests.

For the available beacon endpoint configuration options, see Configure beacon endpoint for web applications.

Headers

RUM uses the following HTTP headers, all of which must be allowed to pass through your infrastructure.

Custom request headers

Header	Purpose
`x-dtc`	Set by the RUM JavaScript when configured as described in Link cross-origin XHR user actions and their distributed traces to carry information required for correlating cross-origin XHRs.
`x-dtpc`	Set by the RUM JavaScript to carry IDs required for RUM beacon routing, user session aggregation, and RUM correlation.
`x-dtreferer`	Set by the RUM JavaScript when the instrumented application modifies the standard `Referer` header during a user action, to preserve the original referer for RUM correlation.
`x-dynatrace-application`	Set by OneAgent on the first instrumented server-side tier (the one closest to the browser) to forward context to downstream OneAgents, such as the detected application ID, the cookie domain, and any applicable custom injection rule.
`x-dynatrace-origin-url`	OneAgent versions before 1.167 Legacy header set on the first instrumented server-side tier (the one closest to the browser) to preserve the original URL of the request in case of URL rewriting.
`X-ruxit-Disposition`	Set by OneAgent to prevent the .NET code module from capturing distributed traces for RUM beacons.

Standard request headers

Header	Purpose
`Accept-Encoding`	Read by OneAgent to determine whether to compress the RUM JavaScript before delivery.
`Cookie`	Set or modified by OneAgent on the first instrumented server-side tier (the one closest to the browser) when no `dtCookie` is present yet, to propagate the cookie value to downstream OneAgents. Once RUM is active in the browser, the browser also adds cookies set by the RUM JavaScript to this header. See Cookies for details on all RUM cookies.
`If-Match` `If-Modified-Since` `If-None-Match` `If-Unmodified-Since`	Modified by OneAgent when cache control header optimizations are active.
`Referer`	Set by the browser. Captured by OneAgent and by the beacon endpoint on the Cluster ActiveGate for RUM correlation.
`User-Agent`	Set by the browser. Read by OneAgent to evaluate browser exclusion rules, and captured by beacon endpoints for browser and OS detection. Setting it to `dtHealthCheck` triggers OneAgent's RUM health check.

Custom response headers

Header	Purpose
`x-dtAgentId`	Set by OneAgent when its RUM health check is active, carrying the IDs of the OneAgent code modules involved in handling the request.
`x-dtHealthCheck`	Set by OneAgent when its RUM health check is active, carrying the health check results.
`X-OneAgent-JS-Injection` `X-ruxit-JS-Agent`	Set by OneAgent to indicate that it has started injecting the RUM JavaScript, preventing duplicate injection.

Standard response headers

Header	Purpose
`Access-Control-Allow-Headers` `Access-Control-Allow-Methods` `Access-Control-Max-Age`	Set by beacon endpoints for responses to `OPTIONS` requests.
`Access-Control-Allow-Origin`	Set by beacon endpoints for responses to RUM beacons. To control from which origins beacons are accepted, configure the beacon origin allowlist. Also set for responses to requests for the RUM monitoring code when they are handled via the Dynatrace CDN.
`Cache-Control`	Set for responses to RUM beacons and requests for the RUM monitoring code.
`Content-Encoding`	Set for responses to requests for the RUM monitoring code; also read during HTML injection.
`Content-Length`	Adapted upon HTML injection, and set for responses to RUM beacons and requests for the RUM monitoring code.
`Content-Type`	Set for responses to RUM beacons and requests for the RUM monitoring code, and read during HTML injection.
`ETag`	When cache control header optimizations are active, OneAgent appends a suffix to the original header value. It may set the header if the application doesn't.
`Expires`	Set for responses to requests for the RUM monitoring code when they are handled via the Dynatrace CDN.
`Last-Modified`	When cache control header optimizations are active, OneAgent subtracts 1 second from the original header value. The header is also set for responses to requests for the RUM monitoring code.
`Server-Timing`	Set by OneAgent to carry information relevant for RUM correlation.
`Set-Cookie`	Set by OneAgent to place the `dtCookie`.
`Strict-Transport-Security`	Set by the beacon endpoint on the Cluster ActiveGate.
`Timing-Allow-Origin`	Set by OneAgent to allow the RUM JavaScript to access the content of the `Server-Timing` header in cross-origin scenarios. Also set for responses to requests for the RUM monitoring code when they are handled via the Dynatrace CDN.
`Transfer-Encoding`	Read by OneAgent during HTML injection.
`Vary`	Set for responses to RUM beacons and requests for the RUM monitoring code.

Cookies

RUM uses the following cookies. All of these must be able to reach Dynatrace. For more details on how Dynatrace uses cookies, and for an explanation of the <suffix> used in the table, see Cookies and client-side storage for RUM and Session Replay.

Cookie	Max size	Purpose
`dtCookie<suffix>`	No set limitation, but usually less than 100 B	Tracks a visit across multiple requests.
`dtPC<suffix>`	58 B	Required for routing RUM beacons; includes session ID for user session aggregation.
`dtSa<suffix>`	Max URL length	Serves as an intermediate storage for page-spanning actions.
`dtValidationCookie<suffix>`	Length of `dTValidationCookieValue` string, that is `23`	Used to determine the top-level domain.
`rxVisitor<suffix>`	45 B	Contains the visitor ID to correlate sessions.
`rxvt<suffix>`	27 B	Stores the session timeout.
`dtsrVID<suffix>`¹	20 B	Specifies the ID of the current recorded view.
`dtSR<suffix>`²	81 B	If Session Replay is enabled, stores the required values to keep the recording consistent through pages.

dtsrVID cookie exists from RUM JavaScript version 1.325+ to RUM JavaScript version 1.333.

The optional cookie dtSR is available from RUM JavaScript version 1.335+.

Mobile applications

Requests

OneAgent for Mobile sends beacon requests to report the captured RUM data. The beacon URL path depends on the configured beacon endpoint:

If beacons are handled by an ActiveGate, the URL path is /mbeacon.
If beacons are handled by a OneAgent instrumenting a web or application server, the URL path is /dtmb.

In addition to the POST requests that report the captured data, OneAgent for Mobile also sends GET requests to the beacon endpoint to retrieve configuration updates. Beacon responses have a text/plain content type.

The beacon URL includes a query string that must not be altered—this includes modifying, removing, or reordering parameters.

Headers

On mobile applications, the following HTTP headers are used, all of which must be allowed to pass through your infrastructure.

Request headers

Header	Purpose
`x-dtc`	Set when you use the Cordova Plugin and manually instrument native web requests. Links native web requests with their server-side distributed traces.
`x-dynatrace`	Set by OneAgent for Mobile to link the mobile part of a web request with the server-side distributed trace.

Response headers

Header	Purpose
`Cache-Control` `Content-Length` `Content-Type`	Set for responses to RUM beacons.
`Strict-Transport-Security`	Set by the ActiveGate beacon endpoint for responses to RUM beacons.

Cookies

The following cookies are used for hybrid applications that combine OneAgent for Mobile with the RUM JavaScript. They need to pass through your infrastructure unaltered.

Cookie	Max size	Purpose
`dtAdk`	92 B	Joins sessions captured by the OneAgent for Mobile and the RUM JavaScript.
`dtAdkSettings`	36 B	Propagates settings between OneAgent for Mobile and the RUM JavaScript.