feat: Detect and report AJAX payloads

[metal-messiah]

Introduces support of AJAX payload capture for XMLHttpRequest and Fetch API calls. When enabled, the browser agent will captures request/response bodies, headers, and query parameters, with automatic detection and parsing of GraphQL operations. Payload capture is configurable to monitor all requests or only failures, with built-in size limits (4KB per attribute) and obfuscation support for sensitive data protection.

New AjaxRequest Attributes

Payload Capture - The Browser Agent can now capture and report request and response payloads for AJAX calls, providing deeper insights into network activity and API interactions.

Configuration:
Enable payload capture using the ajax.capture_payloads configuration option:

• 'all' - Capture payloads for all AJAX requests
• 'failures' - Capture only failed requests (HTTP errors, network errors, or GraphQL errors)
• none - Disable payload capture (default)

New Attributes on AjaxRequest Events:
When AJAX payloads are captured, new attributes are automatically included on AjaxRequest events:

• requestQuery - URL query parameters
• requestHeaders, responseHeaders - HTTP headers
• requestBody, responseBody - Request and response payloads (text-based formats only: JSON, XML, GraphQL, plain text)

GraphQL Detection:
When GraphQL errors are detected, a new additional attribute is automatically included on AjaxRequest events:

• operationHasErrors - Indicates if the operation returned errors

All captured data is automatically truncated to 4KB per attribute and supports obfuscation patterns for sensitive information.

---

Overview

This PR implements comprehensive AJAX payload capture and reporting functionality for the New Relic Browser Agent. The changes include:

• Payload Instrumentation: Enhanced AJAX instrumentation to capture request and response payloads for both XHR and Fetch API calls
• GraphQL Support: Dedicated GraphQL query/mutation detection and parsing (see src/features/ajax/aggregate/gql.js)
• Intelligent Data Handling: Content-type detection to identify human-readable payloads (JSON, XML, text-based formats) and automatic size limiting
• Obfuscation Capabilities: Built-in payload obfuscation to protect sensitive data in captured requests/responses
• Configuration Options: New configuration settings for enabling/disabling payload capture and setting size thresholds (see CAPTURE_PAYLOAD_SETTINGS in src/features/ajax/constants.js)
• Testing Infrastructure: Comprehensive test coverage including:
  • Unit tests for payload parsing, obfuscation, and size handling
  • E2E tests for XHR and Fetch scenarios with both plain and obfuscated payloads
  • Test assets for validating payload capture in real-world scenarios

Key File Changes:

• src/features/ajax/aggregate/payloads.js - Core payload parsing and processing logic
• src/features/ajax/aggregate/gql.js - GraphQL-specific payload handling
• src/features/ajax/instrument/index.js - Enhanced AJAX instrumentation hooks
• tests/specs/ajax/payload_capture.e2e.js - End-to-end payload capture tests
• Multiple test assets for XHR/Fetch with plain and obfuscated payloads

Related Issue(s)

Sister PR to nr-querypack to support testing newrelic/nr-querypack#30 merged

NR-496825
NR-496829
NR-496831
NR-496833

Testing

Unit Tests:

• Payload parsing and query string extraction (tests/unit/features/ajax/instrument/payloads.test.js)
• Content-type detection for human-readable formats
• Payload size limiting and truncation logic
• Obfuscation functionality validation
• GraphQL query/mutation detection and parsing

Integration Tests:

• XHR payload capture with both plain and obfuscated data (tests/assets/ajax/xhr-payloads.html, xhr-payloads-obfuscated.html)
• Fetch API payload capture with both plain and obfuscated data (tests/assets/ajax/fetch-payloads.html, fetch-payloads-obfuscated.html)
• E2E validation of payload reporting through the agent pipeline (tests/specs/ajax/payload_capture.e2e.js)

Manual Testing:

1. Enable payload capture via agent configuration
2. Trigger AJAX requests (XHR and Fetch) with various payload types (JSON, GraphQL, XML, text)
3. Verify payloads are captured and reported correctly in New Relic
4. Test obfuscation patterns to ensure sensitive data is protected
5. Validate size limiting prevents excessive data capture

[github-actions]

Supportability Metric Usage Changes:

No matching changes found

Supportability Metrics .md File Changes:

supportability_metrics.md was changed? false

New supportability metrics require changes to supportability_metrics.md, as well as a new PR to Angler. Please ensure an Angler PR is created and linked to this PR.

[github-actions]

Asset Size Report

Merging this pull request will result in the following asset size changes:

Agent	Asset	Previous Size	New Size	Diff
lite	loader	26.88 kB / 10.23 kB (gzip)	26.79 kB / 10.24 kB (gzip)	-0.31% / 0.17% (gzip)
lite	async-chunk	58.97 kB / 19.75 kB (gzip)	58.92 kB / 19.76 kB (gzip)	-0.08% / 0.03% (gzip)
pro	loader	65.48 kB / 23.06 kB (gzip)	66.48 kB / 23.42 kB (gzip)	1.53% / 1.55% (gzip)
pro	async-chunk	94.35 kB / 29.91 kB (gzip)	96.37 kB / 30.65 kB (gzip)	2.14% / 2.46% (gzip)
spa	loader	67.87 kB / 23.83 kB (gzip)	68.87 kB / 24.19 kB (gzip)	1.47% / 1.49% (gzip)
spa	async-chunk	105.82 kB / 32.9 kB (gzip)	108.52 kB / 33.76 kB (gzip)	2.54% / 2.62% (gzip)

[codecov]

Codecov Report

❌ Patch coverage is 76.25000% with 38 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.90%. Comparing base (c97aaf9) to head (7fd5bfd).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/features/ajax/instrument/index.js	36.20%	31 Missing and 6 partials ⚠️
src/common/payloads/payloads.js	98.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1651      +/-   ##
==========================================
- Coverage   89.07%   88.90%   -0.17%     
==========================================
  Files         212      213       +1     
  Lines        7724     7859     +135     
  Branches     1604     1654      +50     
==========================================
+ Hits         6880     6987     +107     
- Misses        751      776      +25     
- Partials       93       96       +3     

Flag	Coverage Δ
unit-tests	83.66% <76.25%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Last ran on June 12, 2026 09:19:25 CDT
Checking merge of (706e1d1) into main (c97aaf9)