@newrelic/browser-agent 1.316.0 → 1.317.0

package/dist/esm/common/util/obfuscate.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isFileProtocol } from '../url/protocol';
@@ -10,6 +10,7 @@ import { warn } from './console';
  * @typedef {object} ObfuscationRule
  * @property {string|RegExp} regex The regular expression to match against in the payload
  * @property {string} [replacement] The string to replace the matched regex with
+ * @property {string[]} [eventFilter] An optional list of event types to which this rule should be applied. If not provided, or an empty array, the rule will be applied to all events.
  */
 
 /**
@@ -24,14 +25,33 @@ import { warn } from './console';
  */
 
 export class Obfuscator {
-  constructor(agentRef) {
+  /**
+   * @param {Object} agentRef - Reference to the agent instance
+   * @param {string} [eventType] - Optional event type this obfuscator instance handles.
+   *                               If provided, only rules matching this event type (or rules with no eventFilter) will be applied.
+   */
+  constructor(agentRef, eventType) {
     this.agentRef = agentRef;
+    this.eventType = eventType;
     this.warnedRegexMissing = false;
     this.warnedInvalidRegex = false;
     this.warnedInvalidReplacement = false;
   }
   get obfuscateConfigRules() {
-    return this.agentRef.init.obfuscate || [];
+    const allRules = this.agentRef.init.obfuscate || [];
+
+    // If this instance has no specific event type, return all rules
+    if (!this.eventType) return allRules;
+
+    // Filter rules to only those that apply to this instance's event type
+    return allRules.filter(rule => {
+      // If rule has no eventFilter, it applies to all events
+      if (!this.#hasValidEventFilter(rule)) {
+        return true;
+      }
+      // Otherwise, check if this instance's event type matches the rule's filter
+      return rule.eventFilter.includes(this.eventType);
+    });
   }
 
   /**
@@ -57,6 +77,130 @@ export class Obfuscator {
     }, input);
   }
 
+  /**
+   * Traverses an object and obfuscates all string properties.
+   * This instance will only apply rules that match its configured event type (if any).
+   * For features with mixed event types in their payloads (like generic_events), this will
+   * traverse the object and check each object's eventType property against the rules.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @returns {Object|Array} The modified object
+   */
+  traverseAndObfuscateEvents(obj) {
+    if (!obj || typeof obj !== 'object') return obj;
+
+    // If this instance was configured with a specific event type, obfuscate everything
+    // (rules are already filtered in obfuscateConfigRules getter)
+    if (this.eventType) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // For generic obfuscators (no specific event types), check individual eventType properties
+    // This path is for features like generic_events that handle multiple event types
+    const eventTypesToObfuscate = new Set();
+    const globalRules = [];
+    const eventSpecificRules = [];
+    this.obfuscateConfigRules.forEach(rule => {
+      if (this.#hasValidEventFilter(rule)) {
+        eventSpecificRules.push(rule);
+        rule.eventFilter.forEach(eventType => eventTypesToObfuscate.add(eventType));
+      } else {
+        globalRules.push(rule);
+      }
+    });
+
+    // Optimization: if ALL rules are global (no event-specific rules exist),
+    // we can just apply all rules to everything without checking eventType properties
+    if (eventSpecificRules.length === 0) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // We have a mix of global and event-specific rules:
+    // - Apply event-specific rules only to matching eventTypes
+    // - Apply global rules to ALL event types
+    this.#applyFnWithEventTypeFilter(obj, this.obfuscateString.bind(this), Array.from(eventTypesToObfuscate), globalRules, null);
+    return obj;
+  }
+
+  /**
+   * Recursively applies a function to all string properties in an object.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties
+   * @private
+   */
+  #applyFnToAllStrings(obj, fn) {
+    if (!obj || typeof obj !== 'object') return;
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        this.#applyFnToAllStrings(value, fn);
+      } else if (typeof value === 'string') {
+        obj[property] = fn(value);
+      }
+    });
+  }
+
+  /**
+   * Recursively applies a function to string properties based on eventType filtering.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties (applies all rules)
+   * @param {string[]} eventTypes - Array of event types to apply event-specific obfuscation
+   * @param {Array} globalRules - Rules without eventFilter that apply to all events
+   * @param {boolean|null} shouldObfuscate - Track obfuscation state: null = not determined yet, true = obfuscate with all rules, false = obfuscate with global rules only
+   * @private
+   */
+  #applyFnWithEventTypeFilter(obj, fn, eventTypes, globalRules, shouldObfuscate) {
+    if (!obj || typeof obj !== 'object') return;
+
+    // Determine the obfuscation state for this object
+    let currentShouldObfuscate = shouldObfuscate;
+
+    // Check if this object has an eventType property
+    if ('eventType' in obj && typeof obj.eventType === 'string') {
+      currentShouldObfuscate = eventTypes.includes(obj.eventType);
+    }
+
+    // Process all properties
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        // Recursively traverse objects/arrays, passing the current obfuscation state
+        this.#applyFnWithEventTypeFilter(value, fn, eventTypes, globalRules, currentShouldObfuscate);
+      } else if (typeof value === 'string') {
+        if (currentShouldObfuscate === true) {
+          // Apply all rules (both global and event-specific)
+          obj[property] = fn(value);
+        } else if (currentShouldObfuscate === false && globalRules.length > 0) {
+          // Apply only global rules
+          obj[property] = this.#applyRulesToString(value, globalRules);
+        }
+        // If currentShouldObfuscate is null, we haven't found an eventType yet, so don't obfuscate
+      }
+    });
+  }
+
+  /**
+   * Applies specific obfuscation rules to a string.
+   * @param {string} input - The string to obfuscate
+   * @param {Array} rules - The rules to apply
+   * @returns {string} The obfuscated string
+   * @private
+   */
+  #applyRulesToString(input, rules) {
+    if (typeof input !== 'string' || input.trim().length === 0) return input;
+    const validatedRules = rules.map(rule => this.validateObfuscationRule(rule));
+    return validatedRules.filter(ruleValidation => ruleValidation.isValid).reduce((input, ruleValidation) => {
+      const {
+        rule
+      } = ruleValidation;
+      return input.replace(rule.regex, rule.replacement || '*');
+    }, input);
+  }
+  #hasValidEventFilter(rule) {
+    return Array.isArray(rule?.eventFilter) && rule.eventFilter.length > 0;
+  }
+
   /**
    * Validates an obfuscation rule and provides errors if any are found.
    * @param {ObfuscationRule} rule The rule to validate

package/dist/esm/common/wrap/wrap-websocket.js

@@ -8,6 +8,7 @@ import { now } from '../timing/now';
 import { cleanURL } from '../url/clean-url';
 import { gosNREUMOriginals } from '../window/nreum';
 import { subscribeToPageUnload } from '../window/page-visibility';
+import { EVENT_TYPES } from '../constants/events';
 const wrapped = {};
 const openWebSockets = new Set(); // track all instances to close out metrics on page unload
 
@@ -33,7 +34,7 @@ export function wrapWebSocket(sharedEE) {
     });
   });
   class WrappedWebSocket extends WebSocket {
-    static name = 'WebSocket';
+    static name = EVENT_TYPES.WS;
     static toString() {
       // fake native WebSocket when static class is stringified
       return 'function WebSocket() { [native code] }';

package/dist/esm/common/wrap/wrap-xhr.js

@@ -16,7 +16,7 @@ import { globalScope } from '../constants/runtime';
 import { warn } from '../util/console';
 import { findTargetsFromStackTrace } from '../v2/utils';
 const wrapped = {};
-const XHR_PROPS = ['open', 'send']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/dist/esm/features/ajax/aggregate/gql.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isPureObject } from '../../../common/util/type-check';
@@ -89,4 +89,42 @@ function parseGQLQueryString(gqlQueryString) {
 }
 function validateGQLObject(obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string');
+}
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors(response) {
+  return Array.isArray(response?.errors) && response.errors.some(err => err && typeof err === 'object' && typeof err.message === 'string');
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+export function hasGQLErrors(responseBody) {
+  if (!responseBody) return false;
+  try {
+    let parsed = responseBody;
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody);
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors);
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed);
+  } catch (err) {
+    return false;
+  }
 }

package/dist/esm/features/ajax/aggregate/index.js

@@ -6,13 +6,16 @@ import { registerHandler } from '../../../common/event-emitter/register-handler'
 import { stringify } from '../../../common/util/stringify';
 import { handle } from '../../../common/event-emitter/handle';
 import { setDenyList, shouldCollectEvent } from '../../../common/deny-list/deny-list';
-import { AJAX_ID, FEATURE_NAME } from '../constants';
+import { FEATURE_NAME, AJAX_ID } from '../constants';
 import { FEATURE_NAMES } from '../../../loaders/features/features';
 import { AggregateBase } from '../../utils/aggregate-base';
-import { parseGQL } from './gql';
 import { nullable, numeric, getAddStringContext, addCustomAttributes } from '../../../common/serialize/bel-serializer';
 import { gosNREUMOriginals } from '../../../common/window/nreum';
+import { hasGQLErrors, parseGQL } from './gql';
+import { canCapturePayload, isLikelyHumanReadable, parseQueryString, createStringAdders } from '../../../common/payloads/payloads';
+import { Obfuscator } from '../../../common/util/obfuscate';
 import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils';
+import { EVENT_TYPES } from '../../../common/constants/events';
 import { generateUuid } from '../../../common/ids/unique-id';
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME;
@@ -20,6 +23,9 @@ export class Aggregate extends AggregateBase {
     super(agentRef, FEATURE_NAME);
     setDenyList(agentRef.runtime.denyList);
     const classThis = this;
+
+    // Create obfuscator for AJAX requests
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.AJAX);
     if (!agentRef.init.ajax.block_internal) {
       // if the agent is tracking ITSELF, it can spawn endless ajax requests early if they are large from custom attributes, so we just disable early harvest for ajax in this case.
       super.canHarvestEarly = false;
@@ -84,17 +90,26 @@ export class Aggregate extends AggregateBase {
       callbackDuration: metrics.cbTime,
       [AJAX_ID]: generateUuid() // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
     };
+    event.gql = params.gql = parseGQL({
+      body: ctx.requestBody,
+      query: ctx.parsedOrigin?.search
+    });
+    if (event.gql) event.gql.operationHasErrors = params.gql.operationHasErrors = hasGQLErrors(ctx.responseBody);
+    const capturePayloadSetting = this.agentRef.init.ajax.capture_payloads;
+    const shouldCapturePayload = canCapturePayload(capturePayloadSetting, params.status, event.gql?.operationHasErrors);
+    if (shouldCapturePayload) {
+      // Store raw data; obfuscation and truncation will happen in the serializer
+      params.requestQuery = event.requestQuery = parseQueryString(ctx.parsedOrigin?.search);
+      params.requestHeaders = event.requestHeaders = ctx.requestHeaders;
+      params.responseHeaders = event.responseHeaders = ctx.responseHeaders;
+      if (isLikelyHumanReadable(ctx.requestHeaders, ctx.requestBody)) params.requestBody = event.requestBody = ctx.requestBody;
+      if (isLikelyHumanReadable(ctx.responseHeaders, ctx.responseBody)) params.responseBody = event.responseBody = ctx.responseBody;
+    }
     if (ctx.dt) {
       event.spanId = ctx.dt.spanId;
       event.traceId = ctx.dt.traceId;
       event.spanTimestamp = Math.floor(this.agentRef.runtime.timeKeeper.correctAbsoluteTimestamp(ctx.dt.timestamp));
     }
-
-    // parsed from the AJAX body, looking for operationName param & parsing query for operationType
-    event.gql = params.gql = parseGQL({
-      body: ctx.body,
-      query: ctx.parsedOrigin?.search
-    });
     if (event.gql) this.reportSupportabilityMetric('Ajax/Events/GraphQL/Bytes-Added', stringify(event.gql).length);
 
     /** make a copy of the event for the MFE target if it exists */
@@ -122,7 +137,10 @@ export class Aggregate extends AggregateBase {
   }
   serializer(eventBuffer) {
     if (!eventBuffer.length) return;
-    const addString = getAddStringContext(this.agentRef.runtime.obfuscator);
+    const {
+      addString,
+      addStringWithTruncation
+    } = createStringAdders(getAddStringContext, this.obfuscator);
     let payload = 'bel.7;';
     let firstTimestamp = 0;
     for (let i = 0; i < eventBuffer.length; i++) {
@@ -147,15 +165,35 @@ export class Aggregate extends AggregateBase {
       // Since configuration objects (like info) are created new each time they are set, we have to grab the current pointer to the attr object here.
       const jsAttributes = this.agentRef.info.jsAttributes;
 
-      // add custom attributes
-      // gql decorators are added as custom attributes to alleviate need for new BEL schema
-      const attrParts = addCustomAttributes({
+      // Regular attributes: obfuscate only
+      const regularAttrs = addCustomAttributes({
         ...(jsAttributes || {}),
-        ...(event.gql || {}),
+        [AJAX_ID]: event[AJAX_ID],
+        // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
         ...(event.targetAttributes || {}),
         // used to supply the version 2 attributes, either MFE target or duplication attributes for the main agent app
-        [AJAX_ID]: event[AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
+        ...(event.gql || {})
       }, addString);
+
+      // Payload attributes: obfuscate then truncate
+      const payloadAttrs = addCustomAttributes({
+        ...(event.requestBody ? {
+          requestBody: event.requestBody
+        } : {}),
+        ...(event.requestHeaders ? {
+          requestHeaders: event.requestHeaders
+        } : {}),
+        ...(event.requestQuery ? {
+          requestQuery: event.requestQuery
+        } : {}),
+        ...(event.responseBody ? {
+          responseBody: event.responseBody
+        } : {}),
+        ...(event.responseHeaders ? {
+          responseHeaders: event.responseHeaders
+        } : {})
+      }, addStringWithTruncation);
+      const attrParts = [...regularAttrs, ...payloadAttrs];
       fields.unshift(numeric(attrParts.length));
       insert += fields.join(',');
       if (attrParts && attrParts.length > 0) {

package/dist/esm/features/ajax/constants.js

@@ -4,4 +4,9 @@
  */
 import { FEATURE_NAMES } from '../../loaders/features/features';
 export const FEATURE_NAME = FEATURE_NAMES.ajax;
+export const CAPTURE_PAYLOAD_SETTINGS = {
+  NONE: 'none',
+  FAILURES: 'failures',
+  ALL: 'all'
+};
 export const AJAX_ID = 'ajaxRequest.id';

package/dist/esm/features/ajax/instrument/index.js

@@ -14,7 +14,7 @@ import { parseUrl } from '../../../common/url/parse-url';
 import { DT } from './distributed-tracing';
 import { responseSizeFromXhr } from './response-size';
 import { InstrumentBase } from '../../utils/instrument-base';
-import { FEATURE_NAME } from '../constants';
+import { CAPTURE_PAYLOAD_SETTINGS, FEATURE_NAME } from '../constants';
 import { FEATURE_NAMES } from '../../../loaders/features/features';
 import { SUPPORTABILITY_METRIC } from '../../metrics/constants';
 import { now } from '../../../common/timing/now';
@@ -25,6 +25,7 @@ var handlersLen = handlers.length;
 var origRequest = gosNREUMOriginals().o.REQ;
 var origXHR = gosNREUMOriginals().o.XHR;
 const NR_CAT_HEADER = 'X-NewRelic-App-Data';
+const INTERNAL_ERROR = 'internal-error';
 export class Instrument extends InstrumentBase {
   static featureName = FEATURE_NAME;
   constructor(agentRef) {
@@ -70,10 +71,12 @@ export class Instrument extends InstrumentBase {
   }
 }
 function subscribeToEvents(agentRef, ee, handler, dt) {
+  const shouldInterceptPayloads = [CAPTURE_PAYLOAD_SETTINGS.ALL, CAPTURE_PAYLOAD_SETTINGS.FAILURES].includes(agentRef.init.ajax?.capture_payloads);
   ee.on('new-xhr', onNewXhr);
   ee.on('open-xhr-start', onOpenXhrStart);
   ee.on('open-xhr-end', onOpenXhrEnd);
   ee.on('send-xhr-start', onSendXhrStart);
+  ee.on('setRequestHeader-xhr-start', onSetRequestHeader);
   ee.on('xhr-cb-time', onXhrCbTime);
   ee.on('xhr-load-added', onXhrLoadAdded);
   ee.on('xhr-load-removed', onXhrLoadRemoved);
@@ -145,6 +148,13 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       }
     }
   }
+  function onSetRequestHeader(args, xhr) {
+    // args[0] = header name, args[1] = header value
+    if (shouldInterceptPayloads && args.length >= 2) {
+      this.requestHeaders ??= {};
+      this.requestHeaders[args[0].toLowerCase()] = args[1];
+    }
+  }
   function onSendXhrStart(args, xhr) {
     var metrics = this.metrics;
     var data = args[0];
@@ -154,7 +164,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       if (size) metrics.txSize = size;
     }
     this.startTime = now();
-    this.body = data;
+    this.requestBody = data;
     this.listener = function (evt) {
       try {
         if (evt.type === 'abort' && !context.loadCaptureCalled) {
@@ -163,7 +173,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
         if (evt.type !== 'load' || context.called === context.totalCbs && (context.onloadCalled || typeof xhr.onload !== 'function') && typeof context.end === 'function') context.end(xhr);
       } catch (e) {
         try {
-          ee.emit('internal-error', [e]);
+          ee.emit(INTERNAL_ERROR, [e]);
         } catch (err) {
           // do nothing
         }
@@ -291,8 +301,27 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     addUrl(this, extractUrl(target));
     const method = ('' + (target && target instanceof origRequest && target.method || opts.method || 'GET')).toUpperCase();
     this.params.method = method;
-    this.body = opts.body;
-    this.txSize = dataSize(opts.body) || 0;
+    this.txSize = dataSize(opts.body || target?.body) || 0;
+
+    // Capture request headers
+    try {
+      var headers = opts.headers || target?.headers;
+      if (shouldInterceptPayloads && headers) {
+        this.requestHeaders ??= {};
+        if (headers instanceof Headers) {
+          headers.forEach(function (value, key) {
+            this.requestHeaders[key.toLowerCase()] = value;
+          }.bind(this));
+        } else if (typeof headers === 'object') {
+          for (var key in headers) {
+            this.requestHeaders[key.toLowerCase()] = headers[key];
+          }
+        }
+      }
+    } catch (e) {
+      // Silently fail if we can't access headers
+    }
+    this.requestBody = opts.body || target?.body;
   }
 
   // we capture failed call as status 0, the actual error is ignored
@@ -303,19 +332,45 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if (hasUndefinedHostname(this.params)) return; // don't bother with fetch to url with no hostname
 
     this.params.status = res ? res.status : 0;
+    const finishAndReport = () => {
+      // convert rxSize to a number - handle both string (from content-length header) and number (from fallback)
+      const num = +this.rxSize;
+      const responseSize = this.rxSize != null && !isNaN(num) ? num : undefined;
+      const metrics = {
+        txSize: this.txSize,
+        rxSize: responseSize,
+        duration: this.endTime - this.startTime
+      };
+      const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
+      this.targets.forEach(target => reportToAgg(payload, this, target));
+    };
 
-    // convert rxSize to a number
-    let responseSize;
-    if (typeof this.rxSize === 'string' && this.rxSize.length > 0) {
-      responseSize = +this.rxSize;
+    /** Since accessing fetch bodies is an async process, these are
+     * reasonable conditions to check to not do needless extra work */
+    if (!res || !shouldInterceptPayloads) {
+      finishAndReport();
+      return;
     }
-    const metrics = {
-      txSize: this.txSize,
-      rxSize: responseSize,
-      duration: now() - this.startTime
-    };
-    const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
-    this.targets.forEach(target => reportToAgg(payload, this, target));
+
+    // Clone the response to read the body without consuming the original
+    res.clone().text().then(text => {
+      this.responseBody = text;
+      // Use captured payload size as fallback if content-length header was missing or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!this.rxSize || this.rxSize === '0' || this.rxSize === 0) && text !== undefined && this.params.status !== 0) {
+        this.rxSize = dataSize(text);
+      }
+      if (res?.headers) {
+        this.responseHeaders = {};
+        res.headers.forEach(function (value, key) {
+          this.responseHeaders[key.toLowerCase()] = value;
+        }.bind(this));
+      }
+    }).catch(err => {
+      ee.emit(INTERNAL_ERROR, [err]);
+    }).finally(() => {
+      finishAndReport();
+    });
   }
 
   // Create report for XHR request that has finished
@@ -330,7 +385,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if (params.aborted) return;
     if (hasUndefinedHostname(params)) return; // don't bother with XHR of url with no hostname
 
-    metrics.duration = now() - this.startTime;
+    metrics.duration = this.endTime - this.startTime;
     if (!this.loadCaptureCalled && xhr.readyState === 4) {
       captureXhrData(this, xhr);
     } else if (params.status == null) {
@@ -339,6 +394,25 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
 
     // Always send cbTime, even if no noticeable time was taken.
     metrics.cbTime = this.cbTime;
+    if (shouldInterceptPayloads) {
+      try {
+        this.responseBody = xhr.responseText;
+      } catch (e) {
+        this.responseBody = xhr.response;
+      }
+
+      // Use captured payload size as fallback if not already determined or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!metrics.rxSize || metrics.rxSize === 0) && this.responseBody !== undefined && params.status !== 0) {
+        const size = dataSize(this.responseBody);
+        if (size !== undefined) metrics.rxSize = size;
+      }
+      try {
+        this.responseHeaders = parseResponseHeaders(xhr.getAllResponseHeaders());
+      } catch (err) {
+        ee.emit(INTERNAL_ERROR, [err]);
+      }
+    }
     const payload = [params, metrics, this.startTime, this.endTime, 'xhr'];
     this.targets.forEach(target => reportToAgg(payload, this, target));
   }
@@ -348,7 +422,8 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
   function captureXhrData(ctx, xhr) {
     ctx.params.status = xhr.status;
     var size = responseSizeFromXhr(xhr, ctx.lastSize);
-    if (size) ctx.metrics.rxSize = size;
+    // Don't set rxSize for network errors (status 0)
+    if (size !== undefined && xhr.status !== 0) ctx.metrics.rxSize = size;
     if (ctx.sameOrigin && xhr.getAllResponseHeaders().indexOf(NR_CAT_HEADER) >= 0) {
       var header = xhr.getResponseHeader(NR_CAT_HEADER);
       if (header) {
@@ -370,4 +445,17 @@ function addUrl(ctx, url) {
   ctx.parsedOrigin = parsed;
   ctx.sameOrigin = parsed.sameOrigin;
 }
+function parseResponseHeaders(headerStr) {
+  const headers = {};
+  if (!headerStr) return headers;
+  headerStr.split('\r\n').forEach(function (line) {
+    const separatorIndex = line.indexOf(': ');
+    if (separatorIndex > 0) {
+      const name = line.substring(0, separatorIndex);
+      const value = line.substring(separatorIndex + 2);
+      headers[name.toLowerCase()] = value;
+    }
+  });
+  return headers;
+}
 export const Ajax = Instrument;