datadog 2.28.0 → 2.41.0

data/lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "../waf_addresses"
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        module Gateway
+          module Watcher
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request(gateway)
+                watch_response(gateway)
+              end
+
+              def watch_request(gateway = Instrumentation.gateway)
+                gateway.watch("aws_lambda.request.start") do |stack, payload|
+                  context = payload.context
+                  next stack.call(payload) unless context
+
+                  persistent_data = WAFAddresses.from_request(payload.data)
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match? || !result.attributes.empty?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+                  end
+
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(payload)
+                end
+              end
+
+              def watch_response(gateway = Instrumentation.gateway)
+                gateway.watch("aws_lambda.response.start") do |stack, payload|
+                  context = payload.context
+                  next stack.call(payload) unless context
+
+                  persistent_data = WAFAddresses.from_response(payload.data)
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(payload)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/integration.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require_relative "patcher"
+require_relative "../integration"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          register_as :aws_lambda, auto_patch: false
+
+          # NOTE: AWS Lambda is a runtime environment, not an installable gem
+          def self.version
+            nil
+          end
+
+          def self.loaded?
+            true
+          end
+
+          def self.compatible?
+            super
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/patcher.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "../../monitor"
+require_relative "gateway/watcher"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Monitor::Gateway::Watcher.watch
+            Gateway::Watcher.watch
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "uri"
+
+require_relative "../../utils/http/media_type"
+require_relative "../../utils/http/body"
+require_relative "../../../core/utils/base64_codec"
+require_relative "../../../core/header_collection"
+require_relative "../../../tracing/client_ip"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        # Extracts WAF input addresses from normalized AWS Lambda API Gateway event payloads.
+        # @api private
+        module WAFAddresses
+          BASE64_CHARS_PER_GROUP = 4
+          BASE64_BYTES_PER_GROUP = 3
+          BASE64_PADDING_BYTE = "=".ord
+
+          module_function
+
+          def from_request(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              "server.request.cookies" => parse_cookies(payload, headers),
+              "server.request.query" => payload["query"],
+              "server.request.uri.raw" => build_fullpath(payload),
+              "server.request.headers" => headers,
+              "server.request.headers.no_cookies" => headers.dup.tap { |h| h.delete("cookie") },
+              "server.request.method" => payload["method"],
+              "server.request.body" => parse_body(payload, headers),
+              "server.request.body.byte_length" => body_byte_length(payload),
+              "server.request.path_params" => payload["path_params"],
+              "http.client_ip" => extract_client_ip(payload["source_ip"], headers),
+            }
+
+            data.compact!
+            data
+          end
+
+          def from_response(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              "server.response.status" => payload["status_code"]&.to_s,
+              "server.response.headers" => headers,
+              "server.response.headers.no_cookies" => headers.dup.tap { |h| h.delete("set-cookie") },
+              "server.response.body" => parse_body(payload, headers),
+              "server.response.body.byte_length" => body_byte_length(payload),
+            }
+
+            data.compact!
+            data
+          end
+
+          def parse_headers(payload)
+            (payload["headers"] || {}).each_with_object({}) do |(key, value), hash|
+              hash[key.downcase] = value
+            end
+          end
+
+          def parse_cookies(payload, headers)
+            raw_pairs = payload["cookies"] || headers["cookie"]&.split(";")
+            return unless raw_pairs
+
+            raw_pairs.each_with_object({}) do |pair, hash|
+              name, value = pair.strip.split("=", 2)
+              hash[name] = value if name
+            end
+          end
+
+          def build_fullpath(payload)
+            path = payload["path"]
+            return unless path
+
+            query_string = build_query_string(payload)
+            query_string ? "#{path}?#{query_string}" : path
+          end
+
+          def build_query_string(payload)
+            query_string = payload["query_string"]
+            return query_string if query_string && !query_string.empty?
+
+            query = payload["query"]
+            return if query.nil? || query.empty?
+
+            URI.encode_www_form(query)
+          end
+
+          def extract_client_ip(remote_ip, headers)
+            header_collection = Datadog::Core::HeaderCollection.from_hash(headers)
+            Datadog::Tracing::ClientIp.extract_client_ip(header_collection, remote_ip)
+          end
+
+          def parse_body(payload, headers)
+            body = payload["body"]
+            return unless body
+
+            if (byte_length = body_byte_length(payload))
+              return if byte_length > Datadog.configuration.appsec.body_parsing_size_limit
+            end
+
+            content_type = headers["content-type"]
+            return unless content_type
+
+            media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
+            return unless media_type
+
+            body = Core::Utils::Base64Codec.strict_decode64(body) if payload["base64_encoded"]
+            AppSec::Utils::HTTP::Body.parse(
+              body, media_type: media_type, limit: Datadog.configuration.appsec.body_parsing_size_limit
+            )
+          rescue ArgumentError => e
+            AppSec.telemetry.report(e, description: "AppSec: Failed to decode base64 body")
+
+            nil
+          end
+
+          def body_byte_length(payload)
+            body = payload["body"]
+
+            return unless body
+            return body.bytesize unless payload["base64_encoded"]
+
+            # NOTE: Base64 packs every 3 bytes into 4 characters and pads the last
+            #       group with up to two "=" bytes. The decoded length is therefore
+            #       derivable from the encoded length, letting us measure the raw
+            #       body size without allocating the decoded string.
+            padding = 0
+            if body.getbyte(-1) == BASE64_PADDING_BYTE
+              padding = 1
+              padding = 2 if body.getbyte(-2) == BASE64_PADDING_BYTE
+            end
+
+            body.bytesize / BASE64_CHARS_PER_GROUP * BASE64_BYTES_PER_GROUP - padding
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/configuration.rb

@@ -11,7 +11,7 @@ module Datadog
             AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE =>
               AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
             AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE =>
-              AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+              AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE,
           }.freeze
 
           module_function

data/lib/datadog/appsec/contrib/devise/data_extractor.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../anonymizer'
+require_relative "../../anonymizer"
 
 module Datadog
   module AppSec
@@ -9,8 +9,8 @@ module Datadog
         # Extracts user identification data from Devise resources.
         # Supports both regular and anonymized data extraction modes.
         class DataExtractor
-          PRIORITY_ORDERED_ID_KEYS = [:id, 'id', :uuid, 'uuid'].freeze
-          PRIORITY_ORDERED_LOGIN_KEYS = [:email, 'email', :username, 'username', :login, 'login'].freeze
+          PRIORITY_ORDERED_ID_KEYS = [:id, "id", :uuid, "uuid"].freeze
+          PRIORITY_ORDERED_LOGIN_KEYS = [:email, "email", :username, "username", :login, "login"].freeze
 
           def initialize(mode:)
             @mode = mode

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -6,28 +6,28 @@ module Datadog
       module Devise
         # Devise integration constants
         module Ext
-          EVENT_LOGIN_SUCCESS = 'users.login.success'
-          EVENT_LOGIN_FAILURE = 'users.login.failure'
-          EVENT_SIGNUP = 'users.signup'
+          EVENT_LOGIN_SUCCESS = "users.login.success"
+          EVENT_LOGIN_FAILURE = "users.login.failure"
+          EVENT_SIGNUP = "users.signup"
 
-          TAG_DD_USR_ID = '_dd.appsec.usr.id'
-          TAG_DD_USR_LOGIN = '_dd.appsec.usr.login'
-          TAG_DD_SIGNUP_MODE = '_dd.appsec.events.users.signup.auto.mode'
-          TAG_DD_COLLECTION_MODE = '_dd.appsec.user.collection_mode'
-          TAG_DD_LOGIN_SUCCESS_MODE = '_dd.appsec.events.users.login.success.auto.mode'
-          TAG_DD_LOGIN_FAILURE_MODE = '_dd.appsec.events.users.login.failure.auto.mode'
+          TAG_DD_USR_ID = "_dd.appsec.usr.id"
+          TAG_DD_USR_LOGIN = "_dd.appsec.usr.login"
+          TAG_DD_SIGNUP_MODE = "_dd.appsec.events.users.signup.auto.mode"
+          TAG_DD_COLLECTION_MODE = "_dd.appsec.user.collection_mode"
+          TAG_DD_LOGIN_SUCCESS_MODE = "_dd.appsec.events.users.login.success.auto.mode"
+          TAG_DD_LOGIN_FAILURE_MODE = "_dd.appsec.events.users.login.failure.auto.mode"
 
-          TAG_USR_ID = 'usr.id'
-          TAG_SESSION_ID = 'usr.session_id'
-          TAG_SIGNUP_TRACK = 'appsec.events.users.signup.track'
-          TAG_SIGNUP_USR_ID = 'appsec.events.users.signup.usr.id'
-          TAG_SIGNUP_USR_LOGIN = 'appsec.events.users.signup.usr.login'
-          TAG_LOGIN_FAILURE_TRACK = 'appsec.events.users.login.failure.track'
-          TAG_LOGIN_FAILURE_USR_ID = 'appsec.events.users.login.failure.usr.id'
-          TAG_LOGIN_FAILURE_USR_LOGIN = 'appsec.events.users.login.failure.usr.login'
-          TAG_LOGIN_FAILURE_USR_EXISTS = 'appsec.events.users.login.failure.usr.exists'
-          TAG_LOGIN_SUCCESS_TRACK = 'appsec.events.users.login.success.track'
-          TAG_LOGIN_SUCCESS_USR_LOGIN = 'appsec.events.users.login.success.usr.login'
+          TAG_USR_ID = "usr.id"
+          TAG_SESSION_ID = "usr.session_id"
+          TAG_SIGNUP_TRACK = "appsec.events.users.signup.track"
+          TAG_SIGNUP_USR_ID = "appsec.events.users.signup.usr.id"
+          TAG_SIGNUP_USR_LOGIN = "appsec.events.users.signup.usr.login"
+          TAG_LOGIN_FAILURE_TRACK = "appsec.events.users.login.failure.track"
+          TAG_LOGIN_FAILURE_USR_ID = "appsec.events.users.login.failure.usr.id"
+          TAG_LOGIN_FAILURE_USR_LOGIN = "appsec.events.users.login.failure.usr.login"
+          TAG_LOGIN_FAILURE_USR_EXISTS = "appsec.events.users.login.failure.usr.exists"
+          TAG_LOGIN_SUCCESS_TRACK = "appsec.events.users.login.success.track"
+          TAG_LOGIN_SUCCESS_USR_LOGIN = "appsec.events.users.login.success.usr.login"
         end
       end
     end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,12 +11,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('3.2.1')
+          MINIMUM_VERSION = Gem::Version.new("3.2.1")
 
           register_as :devise, auto_patch: true
 
           def self.version
-            Gem.loaded_specs['devise']&.version
+            Gem.loaded_specs["devise"]&.version
           end
 
           def self.loaded?
@@ -24,7 +24,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            !!(super && (version&.>= MINIMUM_VERSION))
           end
 
           def self.auto_instrument?

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative '../../../core/utils/only_once'
+require_relative "../../../core/utils/only_once"
 
-require_relative 'tracking_middleware'
-require_relative 'patches/signup_tracking_patch'
-require_relative 'patches/signin_tracking_patch'
-require_relative 'patches/skip_signin_tracking_patch'
+require_relative "tracking_middleware"
+require_relative "patches/signup_tracking_patch"
+require_relative "patches/signin_tracking_patch"
+require_relative "patches/skip_signin_tracking_patch"
 
 module Datadog
   module AppSec
@@ -20,7 +20,7 @@ module Datadog
           module_function
 
           def patched?
-            Patcher.instance_variable_get(:@patched)
+            !!Patcher.instance_variable_get(:@patched)
           end
 
           def target_version
@@ -32,7 +32,7 @@ module Datadog
               GUARD_ONCE_PER_APP[app].run do
                 app.middleware.insert_after(Warden::Manager, TrackingMiddleware)
               rescue RuntimeError
-                AppSec.telemetry.error('AppSec: unable to insert Devise TrackingMiddleware')
+                AppSec.telemetry.error("AppSec: unable to insert Devise TrackingMiddleware")
               end
             end
 
@@ -50,7 +50,7 @@ module Datadog
 
             if ::Devise::STRATEGIES.include?(:rememberable)
               # Rememberable strategy is required in autoloaded Rememberable model
-              require 'devise/models/rememberable'
+              require "devise/models/rememberable"
               ::Devise::Strategies::Rememberable.prepend(Patches::SkipSigninTrackingPatch)
             end
 

data/lib/datadog/appsec/contrib/devise/patches/signin_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -18,11 +18,12 @@ module Datadog
               return result unless AppSec.enabled?
               return result if @_datadog_appsec_skip_track_login_event
               return result unless Configuration.auto_user_instrumentation_enabled?
-              return result unless AppSec.active_context
 
               context = AppSec.active_context
+              return result unless context
+
               if context.trace.nil? || context.span.nil?
-                Datadog.logger.debug { 'AppSec: unable to track signin events, due to missing trace or span' }
+                Datadog.logger.debug { "AppSec: unable to track signin events, due to missing trace or span" }
                 return result
               end
 
@@ -30,13 +31,13 @@ module Datadog
 
               if result
                 record_successful_signin(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_SUCCESS)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_SUCCESS)
 
                 return result
               end
 
               record_failed_signin(context, resource)
-              Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_FAILURE)
+              Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_FAILURE)
 
               result
             end
@@ -55,7 +56,7 @@ module Datadog
               end
 
               context.span[Ext::TAG_LOGIN_SUCCESS_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_DD_LOGIN_SUCCESS_MODE] = Configuration.auto_user_instrumentation_mode
 
@@ -63,14 +64,14 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
 
             def record_failed_signin(context, resource)
               extractor = DataExtractor.new(mode: Configuration.auto_user_instrumentation_mode)
 
-              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = "true"
               context.span[Ext::TAG_DD_LOGIN_FAILURE_MODE] = Configuration.auto_user_instrumentation_mode
 
               unless resource
@@ -78,7 +79,7 @@ module Datadog
 
                 context.span[Ext::TAG_DD_USR_LOGIN] = login
                 context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'false'
+                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "false"
 
                 return
               end
@@ -93,7 +94,7 @@ module Datadog
 
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "true"
             end
           end
         end

data/lib/datadog/appsec/contrib/devise/patches/signup_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
                 context = AppSec.active_context
 
                 if context.trace.nil? || context.span.nil?
-                  Datadog.logger.debug { 'AppSec: unable to track signup events, due to missing trace or span' }
+                  Datadog.logger.debug { "AppSec: unable to track signup events, due to missing trace or span" }
                   next yield(resource) if block_given?
                 end
 
@@ -29,7 +29,7 @@ module Datadog
 
                 TraceKeeper.keep!(context.trace)
                 record_successful_signup(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_SIGNUP)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_SIGNUP)
 
                 yield(resource) if block_given?
               end
@@ -43,7 +43,7 @@ module Datadog
               id = extractor.extract_id(resource)
               login = extractor.extract_login(resource_params) || extractor.extract_login(resource)
 
-              context.span[Ext::TAG_SIGNUP_TRACK] = 'true'
+              context.span[Ext::TAG_SIGNUP_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_SIGNUP_USR_LOGIN] ||= login
               context.span[Ext::TAG_DD_SIGNUP_MODE] = Configuration.auto_user_instrumentation_mode
@@ -59,7 +59,7 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
           end

data/lib/datadog/appsec/contrib/devise/tracking_middleware.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'ext'
-require_relative '../../anonymizer'
+require_relative "ext"
+require_relative "../../anonymizer"
 
 module Datadog
   module AppSec
@@ -9,8 +9,8 @@ module Datadog
       module Devise
         # A Rack middleware capable of tracking currently signed user
         class TrackingMiddleware
-          WARDEN_KEY = 'warden'
-          SESSION_ID_KEY = 'session_id'
+          WARDEN_KEY = "warden"
+          SESSION_ID_KEY = "session_id"
 
           def initialize(app)
             @app = app
@@ -23,13 +23,13 @@ module Datadog
             return @app.call(env) unless AppSec.active_context
 
             unless env.key?(WARDEN_KEY)
-              Datadog.logger.debug { 'AppSec: unable to track requests, due to missing warden manager' }
+              Datadog.logger.debug { "AppSec: unable to track requests, due to missing warden manager" }
               return @app.call(env)
             end
 
             context = AppSec.active_context
             if context.trace.nil? || context.span.nil?
-              Datadog.logger.debug { 'AppSec: unable to track requests, due to missing trace or span' }
+              Datadog.logger.debug { "AppSec: unable to track requests, due to missing trace or span" }
               return @app.call(env)
             end
 
@@ -49,7 +49,7 @@ module Datadog
                 #        passing them at first place.
                 #        This is a temporary situation until we refactor events model.
                 AppSec::Instrumentation.gateway.push(
-                  'identity.set_user', AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id)
+                  "identity.set_user", AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id)
                 )
               end
 
@@ -67,7 +67,7 @@ module Datadog
             session_serializer = warden.session_serializer
 
             key = session_key_for(session_serializer, ::Devise.default_scope)
-            id = session_serializer.session[key]&.dig(0, 0)
+            id = extract_record_id(session_serializer.session[key])
 
             return id if ::Devise.mappings.size == 1
             return "#{::Devise.default_scope}:#{id}" if id
@@ -76,7 +76,7 @@ module Datadog
               next if scope == ::Devise.default_scope
 
               key = session_key_for(session_serializer, scope)
-              id = session_serializer.session[key]&.dig(0, 0)
+              id = extract_record_id(session_serializer.session[key])
 
               return "#{scope}:#{id}" if id
             end
@@ -84,6 +84,21 @@ module Datadog
             nil
           end
 
+          # NOTE: This supports Devise's default session serialization:
+          #       `[record.to_key, record.authenticatable_salt]`,
+          #       e.g. `[[1], "0abc..."]`
+          #
+          # WARNING: Applications can redefine Warden serialization, replacing
+          #          this default format
+          def extract_record_id(serialized_record)
+            return unless serialized_record.is_a?(Array)
+
+            record_key = serialized_record[0]
+            return unless record_key.is_a?(Array)
+
+            record_key[0]
+          end
+
           def session_key_for(session_serializer, scope)
             @devise_session_scope_keys[scope] ||= session_serializer.key_for(scope)
           end