Skip to content

Fix V0 HTTP client operation names to prevent duplicate endpoints in APM Endpoints view#10958

Draft
jandro996 wants to merge 8 commits intomasterfrom
alejandro.gonzalez/APPSEC-61670
Draft

Fix V0 HTTP client operation names to prevent duplicate endpoints in APM Endpoints view#10958
jandro996 wants to merge 8 commits intomasterfrom
alejandro.gonzalez/APPSEC-61670

Conversation

@jandro996
Copy link
Copy Markdown
Member

@jandro996 jandro996 commented Mar 25, 2026

Summary

  • Root cause: ClientNamingV0.operationForComponent() returned the generic "http.request" for common HTTP client libraries (Apache HttpClient, HttpURLConnection, Google HTTP Client, Grizzly, Spring WebFlux, Jetty Client, etc.). The APM Endpoints view groups spans by (operationName, method, path), so client spans targeting the same URLs as the service's own endpoints appeared as duplicate, empty endpoint rows alongside the real servlet.request server entries.
  • Fix: Added explicit library-specific operation names for all affected clients, consistent with the existing pattern already used for OkHttp (okhttp.request), Play-WS (play-ws.request), and Netty client (netty.client.request). The "http.request" fallback is preserved for unknown/custom clients.
  • Scope: V0 only. V1 already handles this correctly via http.client.request / http.server.request.

Affected libraries

Component Before After
apache-httpclient / apache-httpclient5 http.request apache-httpclient.request
apache-httpasyncclient http.request apache-httpasyncclient.request
commons-http-client http.request commons-http-client.request
google-http-client http.request google-http-client.request
http-url-connection http.request http-url-connection.request
java-http-client http.request java-http-client.request
grizzly-http-async-client http.request grizzly-http-async-client.request
spring-webflux-client http.request spring-webflux-client.request
jetty-client http.request jetty-client.request
unknown/custom clients http.request http.request (unchanged)

Test plan

  • New unit test ClientNamingV0OperationNameTest certifies: each fixed library returns its specific name; pre-existing entries (okhttp, play-ws, netty, akka, pekko, jax-rs) are unaffected; unknown clients still fall back to http.request; no fixed name collides with servlet.request or serverNaming.operationForProtocol("http"); APM Endpoints view aggregation keys differ between client and server spans for the same URL
  • 24 integration test V0 classes updated to assert the new specific operation names
  • All affected modules build and pass locally

🤖 Generated with Claude Code

@jandro996 @claude
Fix V0 HTTP client operation names to prevent duplicate endpoints in …
4972ba0 
…APM Endpoints view

Common HTTP client libraries (Apache HttpClient, HttpURLConnection, etc.) were falling
through to the generic "http.request" default in ClientNamingV0.operationForComponent(),
causing the APM Endpoints view to show spurious duplicate endpoint rows — one for the
real servlet.request server span and one for each client span with the same URL path.

Each well-known HTTP client now has a distinct library-specific operation name consistent
with the existing pattern for OkHttp ("okhttp.request"), Play-WS ("play-ws.request"),
and Netty client ("netty.client.request"). The generic "http.request" fallback is kept
for truly unknown/custom HTTP clients.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@pr-commenter
Copy link
Copy Markdown

pr-commenter bot commented Mar 25, 2026 •
edited
Loading

Benchmarks

Startup

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774576388 1774605208
git_commit_sha f007c41 771c627
release_version 1.61.0-SNAPSHOT~f007c415dd 1.61.0-SNAPSHOT~771c627d5f
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1774607135 1774607135
ci_job_id 1544550675 1544550675
ci_pipeline_id 104719885 104719885
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-0-d0uzqd3b 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-0-d0uzqd3b 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module Agent Agent
parent None None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 67 metrics, 4 unstable metrics.

Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.06 s) : 0, 1059556
Total [baseline] (11.109 s) : 0, 11108506
Agent [candidate] (1.062 s) : 0, 1062104
Total [candidate] (11.061 s) : 0, 11060750
section appsec
Agent [baseline] (1.246 s) : 0, 1246394
Total [baseline] (11.172 s) : 0, 11171734
Agent [candidate] (1.248 s) : 0, 1247940
Total [candidate] (11.232 s) : 0, 11231938
section iast
Agent [baseline] (1.23 s) : 0, 1229983
Total [baseline] (11.46 s) : 0, 11460487
Agent [candidate] (1.237 s) : 0, 1236539
Total [candidate] (11.397 s) : 0, 11397303
section profiling
Agent [baseline] (1.186 s) : 0, 1185808
Total [baseline] (11.028 s) : 0, 11027993
Agent [candidate] (1.183 s) : 0, 1183053
Total [candidate] (10.991 s) : 0, 10990575
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.06 s -
Agent appsec 1.246 s 186.839 ms (17.6%)
Agent iast 1.23 s 170.428 ms (16.1%)
Agent profiling 1.186 s 126.252 ms (11.9%)
Total tracing 11.109 s -
Total appsec 11.172 s 63.227 ms (0.6%)
Total iast 11.46 s 351.98 ms (3.2%)
Total profiling 11.028 s -80.513 ms (-0.7%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.062 s -
Agent appsec 1.248 s 185.836 ms (17.5%)
Agent iast 1.237 s 174.435 ms (16.4%)
Agent profiling 1.183 s 120.95 ms (11.4%)
Total tracing 11.061 s -
Total appsec 11.232 s 171.188 ms (1.5%)
Total iast 11.397 s 336.553 ms (3.0%)
Total profiling 10.991 s -70.176 ms (-0.6%) 
gantt
    title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.206 ms) : 0, 1206
crashtracking [candidate] (1.214 ms) : 0, 1214
BytebuddyAgent [baseline] (630.319 ms) : 0, 630319
BytebuddyAgent [candidate] (631.224 ms) : 0, 631224
AgentMeter [baseline] (29.526 ms) : 0, 29526
AgentMeter [candidate] (29.728 ms) : 0, 29728
GlobalTracer [baseline] (257.736 ms) : 0, 257736
GlobalTracer [candidate] (258.225 ms) : 0, 258225
AppSec [baseline] (31.845 ms) : 0, 31845
AppSec [candidate] (31.952 ms) : 0, 31952
Debugger [baseline] (60.523 ms) : 0, 60523
Debugger [candidate] (60.656 ms) : 0, 60656
Remote Config [baseline] (593.048 µs) : 0, 593
Remote Config [candidate] (591.346 µs) : 0, 591
Telemetry [baseline] (8.082 ms) : 0, 8082
Telemetry [candidate] (8.068 ms) : 0, 8068
Flare Poller [baseline] (3.532 ms) : 0, 3532
Flare Poller [candidate] (4.297 ms) : 0, 4297
section appsec
crashtracking [baseline] (1.187 ms) : 0, 1187
crashtracking [candidate] (1.195 ms) : 0, 1195
BytebuddyAgent [baseline] (657.62 ms) : 0, 657620
BytebuddyAgent [candidate] (659.0 ms) : 0, 659000
AgentMeter [baseline] (12.192 ms) : 0, 12192
AgentMeter [candidate] (12.211 ms) : 0, 12211
GlobalTracer [baseline] (257.739 ms) : 0, 257739
GlobalTracer [candidate] (258.592 ms) : 0, 258592
IAST [baseline] (24.141 ms) : 0, 24141
IAST [candidate] (24.198 ms) : 0, 24198
AppSec [baseline] (177.284 ms) : 0, 177284
AppSec [candidate] (177.719 ms) : 0, 177719
Debugger [baseline] (67.055 ms) : 0, 67055
Debugger [candidate] (66.197 ms) : 0, 66197
Remote Config [baseline] (651.827 µs) : 0, 652
Remote Config [candidate] (620.959 µs) : 0, 621
Telemetry [baseline] (8.412 ms) : 0, 8412
Telemetry [candidate] (8.334 ms) : 0, 8334
Flare Poller [baseline] (3.719 ms) : 0, 3719
Flare Poller [candidate] (3.557 ms) : 0, 3557
section iast
crashtracking [baseline] (1.196 ms) : 0, 1196
crashtracking [candidate] (1.198 ms) : 0, 1198
BytebuddyAgent [baseline] (796.114 ms) : 0, 796114
BytebuddyAgent [candidate] (802.438 ms) : 0, 802438
AgentMeter [baseline] (11.512 ms) : 0, 11512
AgentMeter [candidate] (11.683 ms) : 0, 11683
GlobalTracer [baseline] (248.492 ms) : 0, 248492
GlobalTracer [candidate] (248.954 ms) : 0, 248954
IAST [baseline] (25.507 ms) : 0, 25507
IAST [candidate] (25.504 ms) : 0, 25504
AppSec [baseline] (26.807 ms) : 0, 26807
AppSec [candidate] (26.813 ms) : 0, 26813
Debugger [baseline] (69.7 ms) : 0, 69700
Debugger [candidate] (70.716 ms) : 0, 70716
Remote Config [baseline] (521.935 µs) : 0, 522
Remote Config [candidate] (526.036 µs) : 0, 526
Telemetry [baseline] (10.382 ms) : 0, 10382
Telemetry [candidate] (9.109 ms) : 0, 9109
Flare Poller [baseline] (3.521 ms) : 0, 3521
Flare Poller [candidate] (3.369 ms) : 0, 3369
section profiling
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.179 ms) : 0, 1179
BytebuddyAgent [baseline] (684.985 ms) : 0, 684985
BytebuddyAgent [candidate] (683.732 ms) : 0, 683732
AgentMeter [baseline] (9.074 ms) : 0, 9074
AgentMeter [candidate] (8.966 ms) : 0, 8966
GlobalTracer [baseline] (215.183 ms) : 0, 215183
GlobalTracer [candidate] (214.656 ms) : 0, 214656
AppSec [baseline] (32.569 ms) : 0, 32569
AppSec [candidate] (32.238 ms) : 0, 32238
Debugger [baseline] (66.209 ms) : 0, 66209
Debugger [candidate] (65.734 ms) : 0, 65734
Remote Config [baseline] (571.163 µs) : 0, 571
Remote Config [candidate] (561.891 µs) : 0, 562
Telemetry [baseline] (7.732 ms) : 0, 7732
Telemetry [candidate] (7.708 ms) : 0, 7708
Flare Poller [baseline] (3.525 ms) : 0, 3525
Flare Poller [candidate] (3.457 ms) : 0, 3457
ProfilingAgent [baseline] (93.737 ms) : 0, 93737
ProfilingAgent [candidate] (93.995 ms) : 0, 93995
Profiling [baseline] (94.295 ms) : 0, 94295
Profiling [candidate] (94.553 ms) : 0, 94553
Loading
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1058328
Total [baseline] (8.867 s) : 0, 8867025
Agent [candidate] (1.062 s) : 0, 1062206
Total [candidate] (8.85 s) : 0, 8850150
section iast
Agent [baseline] (1.238 s) : 0, 1238190
Total [baseline] (9.586 s) : 0, 9585884
Agent [candidate] (1.226 s) : 0, 1225678
Total [candidate] (9.557 s) : 0, 9557465
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.058 s -
Agent iast 1.238 s 179.862 ms (17.0%)
Total tracing 8.867 s -
Total iast 9.586 s 718.859 ms (8.1%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.062 s -
Agent iast 1.226 s 163.473 ms (15.4%)
Total tracing 8.85 s -
Total iast 9.557 s 707.314 ms (8.0%) 
gantt
    title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.204 ms) : 0, 1204
crashtracking [candidate] (1.199 ms) : 0, 1199
BytebuddyAgent [baseline] (630.25 ms) : 0, 630250
BytebuddyAgent [candidate] (632.705 ms) : 0, 632705
AgentMeter [baseline] (29.56 ms) : 0, 29560
AgentMeter [candidate] (29.573 ms) : 0, 29573
GlobalTracer [baseline] (257.391 ms) : 0, 257391
GlobalTracer [candidate] (258.366 ms) : 0, 258366
AppSec [baseline] (31.873 ms) : 0, 31873
AppSec [candidate] (31.976 ms) : 0, 31976
Debugger [baseline] (59.702 ms) : 0, 59702
Debugger [candidate] (59.971 ms) : 0, 59971
Remote Config [baseline] (592.275 µs) : 0, 592
Remote Config [candidate] (598.177 µs) : 0, 598
Telemetry [baseline] (8.038 ms) : 0, 8038
Telemetry [candidate] (8.024 ms) : 0, 8024
Flare Poller [baseline] (3.516 ms) : 0, 3516
Flare Poller [candidate] (3.569 ms) : 0, 3569
section iast
crashtracking [baseline] (1.225 ms) : 0, 1225
crashtracking [candidate] (1.197 ms) : 0, 1197
BytebuddyAgent [baseline] (803.867 ms) : 0, 803867
BytebuddyAgent [candidate] (795.045 ms) : 0, 795045
AgentMeter [baseline] (11.661 ms) : 0, 11661
AgentMeter [candidate] (11.407 ms) : 0, 11407
GlobalTracer [baseline] (249.349 ms) : 0, 249349
GlobalTracer [candidate] (247.279 ms) : 0, 247279
IAST [baseline] (25.655 ms) : 0, 25655
IAST [candidate] (25.287 ms) : 0, 25287
AppSec [baseline] (26.928 ms) : 0, 26928
AppSec [candidate] (26.479 ms) : 0, 26479
Debugger [baseline] (69.293 ms) : 0, 69293
Debugger [candidate] (66.529 ms) : 0, 66529
Remote Config [baseline] (519.899 µs) : 0, 520
Remote Config [candidate] (515.889 µs) : 0, 516
Telemetry [baseline] (9.874 ms) : 0, 9874
Telemetry [candidate] (12.063 ms) : 0, 12063
Flare Poller [baseline] (3.44 ms) : 0, 3440
Flare Poller [candidate] (3.741 ms) : 0, 3741
Loading

Load

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774576388 1774605208
git_commit_sha f007c41 771c627
release_version 1.61.0-SNAPSHOT~f007c415dd 1.61.0-SNAPSHOT~771c627d5f
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1774607617 1774607617
ci_job_id 1544550676 1544550676
ci_pipeline_id 104719885 104719885
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-0-km52cmv6 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-0-km52cmv6 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 4 performance improvements and 1 performance regressions! Performance is the same for 15 metrics, 16 unstable metrics.

scenario Δ mean agg_http_req_duration_p50 Δ mean agg_http_req_duration_p95 Δ mean throughput candidate mean agg_http_req_duration_p50 candidate mean agg_http_req_duration_p95 candidate mean throughput baseline mean agg_http_req_duration_p50 baseline mean agg_http_req_duration_p95 baseline mean throughput
scenario:load:insecure-bank:profiling:high_load better
[-204.407µs; -51.209µs] or [-11.223%; -2.812%]		 unstable
[-1039.718µs; -162.211µs] or [-18.439%; -2.877%]		 unstable
[-48.321op/s; +422.383op/s] or [-2.492%; +21.786%]		 1.694ms 5.038ms 2125.781op/s 1.821ms 5.639ms 1938.750op/s
scenario:load:insecure-bank:iast_FULL:high_load worse
[+164.463µs; +372.173µs] or [+3.226%; +7.300%]		 unsure
[+81.404µs; +536.385µs] or [+0.668%; +4.399%]		 unstable
[-106.050op/s; +47.175op/s] or [-13.170%; +5.859%]		 5.367ms 12.504ms 775.781op/s 5.098ms 12.195ms 805.219op/s
scenario:load:petclinic:code_origins:high_load better
[-1198.600µs; -425.009µs] or [-6.524%; -2.313%]		 same
[-1298.228µs; +421.975µs] or [-4.371%; +1.421%]		 unstable
[-17.611op/s; +36.423op/s] or [-7.068%; +14.619%]		 17.560ms 29.263ms 258.562op/s 18.371ms 29.701ms 249.156op/s
scenario:load:petclinic:profiling:high_load better
[-2.025ms; -0.904ms] or [-10.148%; -4.531%]		 better
[-2.633ms; -0.975ms] or [-8.321%; -3.082%]		 unstable
[-9.905op/s; +41.655op/s] or [-4.268%; +17.950%]		 18.495ms 29.833ms 247.938op/s 19.960ms 31.637ms 232.062op/s
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd
    dateFormat X
    axisFormat %s
section baseline
no_agent (18.436 ms) : 18247, 18625
.   : milestone, 18436,
appsec (18.369 ms) : 18185, 18552
.   : milestone, 18369,
code_origins (18.737 ms) : 18551, 18923
.   : milestone, 18737,
iast (17.672 ms) : 17497, 17846
.   : milestone, 17672,
profiling (20.12 ms) : 19912, 20327
.   : milestone, 20120,
tracing (17.914 ms) : 17735, 18094
.   : milestone, 17914,
section candidate
no_agent (18.168 ms) : 17982, 18353
.   : milestone, 18168,
appsec (18.397 ms) : 18211, 18584
.   : milestone, 18397,
code_origins (18.049 ms) : 17868, 18231
.   : milestone, 18049,
iast (17.847 ms) : 17669, 18026
.   : milestone, 17847,
profiling (18.825 ms) : 18637, 19012
.   : milestone, 18825,
tracing (18.031 ms) : 17855, 18207
.   : milestone, 18031,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 18.436 ms [18.247 ms, 18.625 ms] -
appsec 18.369 ms [18.185 ms, 18.552 ms] -67.063 µs (-0.4%)
code_origins 18.737 ms [18.551 ms, 18.923 ms] 301.453 µs (1.6%)
iast 17.672 ms [17.497 ms, 17.846 ms] -764.184 µs (-4.1%)
profiling 20.12 ms [19.912 ms, 20.327 ms] 1.684 ms (9.1%)
tracing 17.914 ms [17.735 ms, 18.094 ms] -521.428 µs (-2.8%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 18.168 ms [17.982 ms, 18.353 ms] -
appsec 18.397 ms [18.211 ms, 18.584 ms] 229.755 µs (1.3%)
code_origins 18.049 ms [17.868 ms, 18.231 ms] -118.143 µs (-0.7%)
iast 17.847 ms [17.669 ms, 18.026 ms] -320.17 µs (-1.8%)
profiling 18.825 ms [18.637 ms, 19.012 ms] 657.11 µs (3.6%)
tracing 18.031 ms [17.855 ms, 18.207 ms] -136.636 µs (-0.8%)
Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.18 ms) : 1169, 1192
.   : milestone, 1180,
iast (3.291 ms) : 3244, 3338
.   : milestone, 3291,
iast_FULL (5.741 ms) : 5683, 5798
.   : milestone, 5741,
iast_GLOBAL (3.587 ms) : 3530, 3645
.   : milestone, 3587,
profiling (2.34 ms) : 2316, 2363
.   : milestone, 2340,
tracing (1.755 ms) : 1740, 1769
.   : milestone, 1755,
section candidate
no_agent (1.188 ms) : 1176, 1199
.   : milestone, 1188,
iast (3.313 ms) : 3270, 3357
.   : milestone, 3313,
iast_FULL (5.963 ms) : 5903, 6022
.   : milestone, 5963,
iast_GLOBAL (3.579 ms) : 3517, 3640
.   : milestone, 3579,
profiling (2.127 ms) : 2108, 2146
.   : milestone, 2127,
tracing (1.762 ms) : 1748, 1775
.   : milestone, 1762,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.18 ms [1.169 ms, 1.192 ms] -
iast 3.291 ms [3.244 ms, 3.338 ms] 2.111 ms (178.9%)
iast_FULL 5.741 ms [5.683 ms, 5.798 ms] 4.56 ms (386.4%)
iast_GLOBAL 3.587 ms [3.53 ms, 3.645 ms] 2.407 ms (204.0%)
profiling 2.34 ms [2.316 ms, 2.363 ms] 1.16 ms (98.3%)
tracing 1.755 ms [1.74 ms, 1.769 ms] 574.527 µs (48.7%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.188 ms [1.176 ms, 1.199 ms] -
iast 3.313 ms [3.27 ms, 3.357 ms] 2.126 ms (179.0%)
iast_FULL 5.963 ms [5.903 ms, 6.022 ms] 4.775 ms (402.0%)
iast_GLOBAL 3.579 ms [3.517 ms, 3.64 ms] 2.391 ms (201.3%)
profiling 2.127 ms [2.108 ms, 2.146 ms] 939.279 µs (79.1%)
tracing 1.762 ms [1.748 ms, 1.775 ms] 573.916 µs (48.3%)

Dacapo

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774576388 1774605208
git_commit_sha f007c41 771c627
release_version 1.61.0-SNAPSHOT~f007c415dd 1.61.0-SNAPSHOT~771c627d5f
See matching parameters
Baseline Candidate
application biojava biojava
ci_job_date 1774607333 1774607333
ci_job_id 1544550677 1544550677
ci_pipeline_id 104719885 104719885
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-1-1de6p35v 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-1-1de6p35v 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics.

Execution time for tomcat 
gantt
    title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.475 ms) : 1464, 1487
.   : milestone, 1475,
appsec (3.83 ms) : 3609, 4050
.   : milestone, 3830,
iast (2.266 ms) : 2196, 2335
.   : milestone, 2266,
iast_GLOBAL (2.313 ms) : 2243, 2383
.   : milestone, 2313,
profiling (2.112 ms) : 2055, 2168
.   : milestone, 2112,
tracing (2.085 ms) : 2031, 2138
.   : milestone, 2085,
section candidate
no_agent (1.478 ms) : 1466, 1489
.   : milestone, 1478,
appsec (3.818 ms) : 3597, 4038
.   : milestone, 3818,
iast (2.267 ms) : 2198, 2336
.   : milestone, 2267,
iast_GLOBAL (2.31 ms) : 2240, 2380
.   : milestone, 2310,
profiling (2.096 ms) : 2041, 2151
.   : milestone, 2096,
tracing (2.084 ms) : 2030, 2137
.   : milestone, 2084,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.475 ms [1.464 ms, 1.487 ms] -
appsec 3.83 ms [3.609 ms, 4.05 ms] 2.354 ms (159.6%)
iast 2.266 ms [2.196 ms, 2.335 ms] 790.649 µs (53.6%)
iast_GLOBAL 2.313 ms [2.243 ms, 2.383 ms] 837.784 µs (56.8%)
profiling 2.112 ms [2.055 ms, 2.168 ms] 636.735 µs (43.2%)
tracing 2.085 ms [2.031 ms, 2.138 ms] 609.702 µs (41.3%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.478 ms [1.466 ms, 1.489 ms] -
appsec 3.818 ms [3.597 ms, 4.038 ms] 2.34 ms (158.3%)
iast 2.267 ms [2.198 ms, 2.336 ms] 788.727 µs (53.4%)
iast_GLOBAL 2.31 ms [2.24 ms, 2.38 ms] 832.33 µs (56.3%)
profiling 2.096 ms [2.041 ms, 2.151 ms] 618.003 µs (41.8%)
tracing 2.084 ms [2.03 ms, 2.137 ms] 605.776 µs (41.0%)
Execution time for biojava 
gantt
    title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~771c627d5f, baseline=1.61.0-SNAPSHOT~f007c415dd
    dateFormat X
    axisFormat %s
section baseline
no_agent (14.901 s) : 14901000, 14901000
.   : milestone, 14901000,
appsec (14.822 s) : 14822000, 14822000
.   : milestone, 14822000,
iast (18.325 s) : 18325000, 18325000
.   : milestone, 18325000,
iast_GLOBAL (17.969 s) : 17969000, 17969000
.   : milestone, 17969000,
profiling (14.952 s) : 14952000, 14952000
.   : milestone, 14952000,
tracing (14.735 s) : 14735000, 14735000
.   : milestone, 14735000,
section candidate
no_agent (14.953 s) : 14953000, 14953000
.   : milestone, 14953000,
appsec (14.896 s) : 14896000, 14896000
.   : milestone, 14896000,
iast (18.413 s) : 18413000, 18413000
.   : milestone, 18413000,
iast_GLOBAL (17.928 s) : 17928000, 17928000
.   : milestone, 17928000,
profiling (14.942 s) : 14942000, 14942000
.   : milestone, 14942000,
tracing (14.998 s) : 14998000, 14998000
.   : milestone, 14998000,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 14.901 s [14.901 s, 14.901 s] -
appsec 14.822 s [14.822 s, 14.822 s] -79.0 ms (-0.5%)
iast 18.325 s [18.325 s, 18.325 s] 3.424 s (23.0%)
iast_GLOBAL 17.969 s [17.969 s, 17.969 s] 3.068 s (20.6%)
profiling 14.952 s [14.952 s, 14.952 s] 51.0 ms (0.3%)
tracing 14.735 s [14.735 s, 14.735 s] -166.0 ms (-1.1%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 14.953 s [14.953 s, 14.953 s] -
appsec 14.896 s [14.896 s, 14.896 s] -57.0 ms (-0.4%)
iast 18.413 s [18.413 s, 18.413 s] 3.46 s (23.1%)
iast_GLOBAL 17.928 s [17.928 s, 17.928 s] 2.975 s (19.9%)
profiling 14.942 s [14.942 s, 14.942 s] -11.0 ms (-0.1%)
tracing 14.998 s [14.998 s, 14.998 s] 45.0 ms (0.3%)

@jandro996 jandro996 added type: bug Bug report and fix comp: asm waf Application Security Management (WAF) labels Mar 25, 2026
jandro996 and others added 7 commits March 25, 2026 14:13
@jandro996 @claude
Fix operation name assertions in secondary tests affected by ClientNa…
20b4258 
…mingV0 change

Tests for AWS SDK, Elasticsearch REST client, OpenSearch, and Mule 4 each include
child HTTP client spans within their trace assertions. These spans had their
operation name hardcoded as "http.request" because the underlying HTTP libraries
(Apache HttpClient and Grizzly async client) previously fell through to that default.

Now that these components have explicit V0 operation names, update the assertions
to match: apache-httpclient.request, apache-httpasyncclient.request, and
grizzly-http-async-client.request accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix http.request operation name in OpenLiberty smoke tests
2a59e77 
The Spring Boot OpenLiberty smoke app uses RestTemplate backed by
HttpURLConnection, which now produces "http-url-connection.request"
instead of the generic "http.request" after the ClientNamingV0 fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix remaining test assertions for renamed HTTP client operation names…
7d861f5 
… (round 3)

Update Spring WebFlux bootTest, Spring Cloud Zuul, and AWS SNS tests to use
the new component-specific operation names introduced for V0 schema.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix Twilio test assertion for renamed apache-httpclient operation nam…
29a41b1 
…e (round 4)

TwilioClientV0Test.httpClientOperation() was using the generic ClientV0.operation()
which returned "http.request". Update to "apache-httpclient.request" directly since
Twilio uses the apache-httpclient component for its underlying HTTP requests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix ProxyRequestHelperTest operation name assertions for mixed HTTP c…
07cec72 
…lients

Zuul uses Apache HttpClient for direct proxy forwards, but the backend
makes nested HTTP calls using HttpURLConnection. With the ClientNamingV0
change, these now produce different operation names, requiring per-trace
assertions instead of one uniform operation name.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996
Merge branch 'master' into alejandro.gonzalez/APPSEC-61670
d90d806
@jandro996 @claude
Fix UrlConnectionV0ForkedTest operation name for http-url-connection …
771c627 
…component

The URLConnection tests use HttpUrlConnectionDecorator which calls
operationForComponent("http-url-connection"), now returning
"http-url-connection.request" instead of the protocol-based "http.request".

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp: asm waf Application Security Management (WAF) type: bug Bug report and fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jandro996