fix(feature-flags): constrain direct EVP intake origin - #12299
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 14 commits intoSep 8, 2026
Merged
Conversation
Route direct feature flag intake through standard HTTPS proxy settings and attach the canonical fixed-width API key fingerprint. Environment: Datadog workspace
This comment has been minimized.
This comment has been minimized.
Contributor
🟢 Java Benchmark SLOs — All performance SLOs passed
PR vs. master results
Commit: Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion. |
Keep this PR focused on proxy-aware direct Event Platform intake and leave fingerprinting to an independent change. Environment: Datadog workspace
Keep the direct-intake diff free of fingerprint-only formatting artifacts. Environment: Datadog workspace
leoromanovsky
changed the title
Use the original two-argument direct intake factory now that the unrelated fingerprint header plumbing has moved out of this PR. Environment: Datadog workspace
leoromanovsky
changed the title
Reject URL authority confusion before adding DD-API-KEY. Environment: Datadog workspace
Read standard proxy environment variables without registering them as Datadog configuration aliases, and use the existing non-regex parser for no-proxy hosts. Environment: Datadog workspace
leoromanovsky
added
tag: ai generated
Disable HTTP and HTTPS redirects for Feature Flags direct EVP intake so DD-API-KEY remains bound to the configured origin. Environment: Datadog workspace
leoromanovsky
marked this pull request as ready for review
August 27, 2026 16:14
leoromanovsky
requested review from
amarziali,
danyal002 and
pavlokhrebto
and removed request for
a team
August 27, 2026 16:14
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 489706ce96
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![datadog-datadog-us1-prod[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
A plain NO_PROXY domain does not cover its subdomains. This can send direct intake traffic through a proxy that blocks Datadog.
🤖 Datadog Autotest · Commit 75471e9 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
aarsilv
reviewed
Aug 31, 2026
Keep direct intake origin and redirect protections while removing proxy and runtime failover changes. Environment: Datadog workspace
leoromanovsky
changed the title
…ening\n\nEnvironment: Datadog workspace
leoromanovsky
enabled auto-merge
September 3, 2026 03:54
mcculls
requested review from
daniel-mohedano
and removed request for
daniel-mohedano
September 3, 2026 18:16
Contributor
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
Build pipeline has failing jobs for 87bf55f: What to do next?
DetailsSince those jobs are not marked as being allowed to fail, the pipeline will most likely fail. |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 3, 2026
mcculls
approved these changes
Sep 7, 2026
Contributor
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 8, 2026
gh-worker-dd-mergequeue-cf854d
Bot
merged commit Sep 8, 2026
3b68bdc
into
master
810 of 812 checks passed
gh-worker-dd-mergequeue-cf854d
Bot
deleted the
leo.romanovsky/ffe-agentless-evp-java-hardening
branch
September 8, 2026 12:33
AlexeyKuznetsov-DD
pushed a commit
that referenced
this pull request
Sep 8, 2026
Add proxy-aware feature flag intake authentication Route direct feature flag intake through standard HTTPS proxy settings and attach the canonical fixed-width API key fingerprint. Environment: Datadog workspace Separate direct intake proxying from API key fingerprinting Keep this PR focused on proxy-aware direct Event Platform intake and leave fingerprinting to an independent change. Environment: Datadog workspace Merge live Java master after EVP split Restore Java formatting after the fingerprint split Keep the direct-intake diff free of fingerprint-only formatting artifacts. Environment: Datadog workspace Update direct-intake tests after fingerprint removal Use the original two-argument direct intake factory now that the unrelated fingerprint header plumbing has moved out of this PR. Environment: Datadog workspace Remove unnecessary Groovy imports fix(feature-flags): handle ambiguous EVP failures safely fix(feature-flags): validate direct EVP intake site Reject URL authority confusion before adding DD-API-KEY. Environment: Datadog workspace fix(config): align proxy configuration validation Read standard proxy environment variables without registering them as Datadog configuration aliases, and use the existing non-regex parser for no-proxy hosts. Environment: Datadog workspace fix(feature-flags): reject direct intake redirects Disable HTTP and HTTPS redirects for Feature Flags direct EVP intake so DD-API-KEY remains bound to the configured origin. Environment: Datadog workspace fix(feature-flags): harden proxy configuration Preserve one-character NO_PROXY entries and prevent HTTPS proxy URLs from exposing credentials through configuration telemetry. Environment: Datadog workspace Merge remote-tracking branch 'origin/master' into leo.romanovsky/ffe-agentless-evp-java-hardening # Conflicts: # utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java # utils/config-utils/src/test/java/datadog/trace/api/ConfigSettingTest.java refactor(feature-flags): narrow direct intake hardening Keep direct intake origin and redirect protections while removing proxy and runtime failover changes. Environment: Datadog workspace Merge branch 'master' into leo.romanovsky/ffe-agentless-evp-java-hardening\n\nEnvironment: Datadog workspace Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
that referenced
this pull request
Sep 8, 2026
fix(feature-flags): constrain direct EVP intake origin (#12299) Add proxy-aware feature flag intake authentication Route direct feature flag intake through standard HTTPS proxy settings and attach the canonical fixed-width API key fingerprint. Environment: Datadog workspace Separate direct intake proxying from API key fingerprinting Keep this PR focused on proxy-aware direct Event Platform intake and leave fingerprinting to an independent change. Environment: Datadog workspace Merge live Java master after EVP split Restore Java formatting after the fingerprint split Keep the direct-intake diff free of fingerprint-only formatting artifacts. Environment: Datadog workspace Update direct-intake tests after fingerprint removal Use the original two-argument direct intake factory now that the unrelated fingerprint header plumbing has moved out of this PR. Environment: Datadog workspace Remove unnecessary Groovy imports fix(feature-flags): handle ambiguous EVP failures safely fix(feature-flags): validate direct EVP intake site Reject URL authority confusion before adding DD-API-KEY. Environment: Datadog workspace fix(config): align proxy configuration validation Read standard proxy environment variables without registering them as Datadog configuration aliases, and use the existing non-regex parser for no-proxy hosts. Environment: Datadog workspace fix(feature-flags): reject direct intake redirects Disable HTTP and HTTPS redirects for Feature Flags direct EVP intake so DD-API-KEY remains bound to the configured origin. Environment: Datadog workspace fix(feature-flags): harden proxy configuration Preserve one-character NO_PROXY entries and prevent HTTPS proxy URLs from exposing credentials through configuration telemetry. Environment: Datadog workspace Merge remote-tracking branch 'origin/master' into leo.romanovsky/ffe-agentless-evp-java-hardening # Conflicts: # utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java # utils/config-utils/src/test/java/datadog/trace/api/ConfigSettingTest.java refactor(feature-flags): narrow direct intake hardening Keep direct intake origin and redirect protections while removing proxy and runtime failover changes. Environment: Datadog workspace Merge branch 'master' into leo.romanovsky/ffe-agentless-evp-java-hardening\n\nEnvironment: Datadog workspace Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io> Enable Pekko HTTP forked tests Minor reshuffle. Remove direct Pekko advice test Co-authored-by: leoromanovsky <leo.romanovsky@datadoghq.com> Co-authored-by: alexey.kuznetsov <alexey.kuznetsov@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Agentless Feature Flags sends exposures and flag evaluations directly to Event Platform intake when no compatible local EVP route is available. These requests carry
DD-API-KEY.The direct client currently follows redirects, and a crafted
DD_SITEvalue can make the parsed request host differ fromevent-platform-intake.<DD_SITE>. Either case can send the API key to an unintended origin.Changes
HttpUrl.Builder.event-platform-intake.<DD_SITE>.Decisions
/inforoute selection or local-to-direct fallback classification.Validation
./gradlew :communication:test --tests datadog.communication.BackendApiFactoryTest./gradlew :products:feature-flagging:feature-flagging-lib:test --tests com.datadog.featureflag.FeatureFlagBackendApiFactoryTest --tests com.datadog.featureflag.ExposureWriterTests --tests com.datadog.featureflag.FlagEvaluationWriterImplTest./gradlew :communication:spotlessCheck :communication:forbiddenApisMain :products:feature-flagging:feature-flagging-lib:spotlessCheck :products:feature-flagging:feature-flagging-lib:forbiddenApisMain