[AppSec] APPSEC-65483 Collect Datadog security-testing headers on entry spans

[christophe-papazian]

Summary of changes

Tag x-datadog-endpoint-scan and x-datadog-security-test HTTP request headers as http.request.headers.<name> on every HTTP server entry span (and the inferred-proxy span when one is created), unconditionally — independent of DD_TRACE_HEADER_TAGS and AppSec enablement. Markers are not propagated downstream.

Reason for change

APPSEC-65483 — RFC "Security Testing: Trace Attribution for Inventory Enrichment and Pollution Prevention". These two markers let the API endpoint reducer distinguish Datadog scan/test traffic from real user traffic and keep it out of the API inventory.

Sibling-tracer implementations already merged: dd-trace-py#18049, dd-trace-js#8463, dd-trace-java#11418.

Implementation details

• New SpanContextPropagator.AddSecurityTestingHeadersAsTags<THeaders> reads both markers from any IHeadersCollection and tags them on the supplied span. Tag names are precomputed; string[] fast-path avoids enumerator allocation on the legacy NameValueCollection / WebHeaderCollection carriers; presence-based (empty values still tagged).
• Wired into every HTTP server entry path:
  • AspNetMvcIntegration (System.Web MVC) — entry span + inferred-proxy span (proxy tagged at creation site)
  • AspNetWebApi2Integration (System.Web Web API 2) — entry span (no proxy support on this path)
  • TracingHttpModule (OWIN/IIS classic) — entry span + inferred-proxy span
  • AspNetCoreHttpRequestHandler (ASP.NET Core, including Azure Functions isolated worker HTTP-proxying mode) — entry span + inferred-proxy span
  • WcfCommon (WCF over HTTP) — entry span

Test coverage

• SpanContextPropagatorTests_AddSecurityTestingHeadersAsTags (new — 13 cases): both markers + unrelated header, absent headers, no HeaderTags config, only one marker present, empty-string value still tagged, case-insensitive lookup, ASP.NET Core HeadersCollectionAdapter with mixed-case lookup.
• All existing SpanContextPropagatorTests* continue to pass.

Other details

[datadog-datadog-prod-us1]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 9 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-dotnet | build     

🔧 Fix in code (Fix with Cursor).

Compilation errors related to missing tuple definitions: CS8137 and CS8179 in SpanContextPropagator.cs at line 28.

Verify app trimming xml file changes have been persisted | verify_app_trimming_descriptor_generator     

🔧 Fix in code (Fix with Cursor).

Compilation errors related to tuples in SpanContextPropagator.cs:28:33. Required type 'System.Runtime.CompilerServices.TupleElementNamesAttribute' cannot be found.

Verify source generator changes have been persisted | verify_source_generators     

🔧 Fix in code (Fix with Cursor).

Compilation error in SpanContextPropagator.cs:28:33: Cannot define a class or member that utilizes tuples because the required type 'System.Runtime.CompilerServices.TupleElementNamesAttribute' cannot be found.

View all 9 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5bb6c5e | Docs | Datadog PR Page | Give us feedback!}