@newrelic/browser-agent 1.316.0 → 1.317.0

package/src/common/harvest/harvester.js

@@ -16,6 +16,7 @@ import { warn } from '../util/console'
 import { stringify } from '../util/stringify'
 import { getSubmitMethod, xhr as xhrMethod, xhrFetch as fetchMethod } from '../util/submit-data'
 import { dispatchGlobalEvent } from '../dispatch/global-event'
+import { Obfuscator } from '../util/obfuscate'
 
 const RETRY = 'Harvester/Retry/'
 const RETRY_ATTEMPTED = RETRY + 'Attempted/'
@@ -29,6 +30,10 @@ export class Harvester {
   constructor (agentRef) {
     this.agentRef = agentRef
 
+    // Create obfuscator for harvest metadata (referrer URL, etc.)
+    // No event type specified - applies to all harvests regardless of feature
+    this.obfuscator = new Obfuscator(agentRef)
+
     subscribeToEOL(() => { // do one last harvest round or check
       this.initializedAggregates.forEach(aggregateInst => { // let all features wrap up things needed to do before ANY harvest in case there's last minute cross-feature data dependencies
         if (typeof aggregateInst.harvestOpts.beforeUnload === 'function') aggregateInst.harvestOpts.beforeUnload()
@@ -73,6 +78,7 @@ export class Harvester {
       payload: output.payload,
       localOpts,
       submitMethod,
+      harvesterObfuscator: this.obfuscator,
       cbFinished,
       raw: aggregateInst.harvestOpts.raw,
       featureName: aggregateInst.featureName,
@@ -112,7 +118,7 @@ const warnings = {}
   * @param {NetworkSendSpec} param0 Specification for sending data
   * @returns {boolean} True if a network call was made. Note that this does not mean or guarantee that it was successful.
   */
-export function send (agentRef, { endpoint, payload, localOpts = {}, submitMethod, cbFinished, raw, featureName, endpointVersion = 1 }) {
+export function send (agentRef, { endpoint, payload, localOpts = {}, submitMethod, cbFinished, raw, featureName, endpointVersion = 1, harvesterObfuscator }) {
   if (!agentRef.info.errorBeacon) return false
 
   let { body, qs } = cleanPayload(payload)
@@ -127,7 +133,7 @@ export function send (agentRef, { endpoint, payload, localOpts = {}, submitMetho
   const url = raw
     ? `${protocol}://${perceivedBeacon}/${endpoint}`
     : `${protocol}://${perceivedBeacon}${endpoint !== RUM ? '/' + endpoint : ''}/${endpointVersion}/${agentRef.info.licenseKey}`
-  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint) : ''
+  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) : ''
   let payloadParams = obj(qs, agentRef.runtime.maxBytes)
   if (baseParams === '' && payloadParams.startsWith('&')) {
     payloadParams = payloadParams.substring(1)
@@ -260,8 +266,9 @@ function cleanPayload (payload = {}) {
 }
 
 // The stuff that gets sent every time.
-function baseQueryString (agentRef, qs, endpoint) {
-  const ref = agentRef.runtime.obfuscator.obfuscateString(cleanURL('' + globalScope.location))
+function baseQueryString (agentRef, qs, endpoint, harvesterObfuscator) {
+  const cleanedURL = cleanURL('' + globalScope.location)
+  const ref = harvesterObfuscator?.obfuscateString(cleanedURL) ?? cleanedURL
   const session = agentRef.runtime.session
   const hr = !!session?.state.sessionReplaySentFirstChunk && session?.state.sessionReplayMode === 1 && endpoint !== JSERRORS
   const ht = !!session?.state.traceHarvestStarted && session?.state.sessionTraceMode === 1 && ![LOGS, BLOBS].includes(endpoint)

package/src/common/payloads/payloads.js

@@ -0,0 +1,135 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify'
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants'
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload (captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString (search) {
+  if (!search || search.length === 0) return
+
+  const queryParams = {}
+  try {
+    const searchParams = new URLSearchParams(search)
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value
+    })
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+
+  return queryParams
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable (headers, data) {
+  if (!headers) return typeof data === 'string'
+  var contentType = headers['content-type']
+  if (!contentType) return typeof data === 'string'
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim()
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true
+
+  // Check for specific application/* types
+  var readableAppTypes = [
+    '/json',
+    '/xml',
+    '/xhtml+xml',
+    '/ld+json',
+    '/yaml',
+    '/x-www-form-urlencoded'
+  ]
+
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true
+  }
+
+  return false
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString (data) {
+  if (!data) return data
+  try {
+    if (typeof data !== 'string') data = stringify(data)
+    let bytes = 0
+    let i = 0
+    let needsEllipsis = false
+
+    while (i < data.length) {
+      const c = data.charCodeAt(i)
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4
+
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true
+        break
+      }
+
+      bytes += charBytes
+      i += charBytes === 4 ? 2 : 1
+    }
+
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '')
+  } catch (e) {
+    return data
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders (getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext()
+
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str)
+    if (typeof str !== 'string') str = stringify(str)
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated
+    return addStringRaw(processed)
+  }
+
+  return {
+    addString: (str) => processString(str, false),
+    addStringWithTruncation: (str) => processString(str, true)
+  }
+}

package/src/common/serialize/bel-serializer.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -21,7 +21,7 @@ export function numeric (n, noDefault) {
   return (n === undefined || n === 0) ? '' : Math.floor(n).toString(36)
 }
 
-export function getAddStringContext (obfuscator) {
+export function getAddStringContext (obfuscator, truncator) {
   let stringTableIdx = 0
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {}
 
@@ -29,7 +29,8 @@ export function getAddStringContext (obfuscator) {
 
   function addString (str) {
     if (typeof str === 'undefined' || str === '') return ''
-    str = obfuscator.obfuscateString(String(str))
+    str = obfuscator?.obfuscateString(String(str)) ?? String(str)
+    str = truncator?.(str) ?? str
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true)
     } else {

package/src/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify'
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize (data) {
-  if (typeof data === 'string' && data.length) return data.length
+  if (typeof data === 'string') return data.length
   if (typeof data !== 'object') return undefined
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength

package/src/common/util/obfuscate.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isFileProtocol } from '../url/protocol'
@@ -10,6 +10,7 @@ import { warn } from './console'
  * @typedef {object} ObfuscationRule
  * @property {string|RegExp} regex The regular expression to match against in the payload
  * @property {string} [replacement] The string to replace the matched regex with
+ * @property {string[]} [eventFilter] An optional list of event types to which this rule should be applied. If not provided, or an empty array, the rule will be applied to all events.
  */
 
 /**
@@ -24,15 +25,34 @@ import { warn } from './console'
  */
 
 export class Obfuscator {
-  constructor (agentRef) {
+  /**
+   * @param {Object} agentRef - Reference to the agent instance
+   * @param {string} [eventType] - Optional event type this obfuscator instance handles.
+   *                               If provided, only rules matching this event type (or rules with no eventFilter) will be applied.
+   */
+  constructor (agentRef, eventType) {
     this.agentRef = agentRef
+    this.eventType = eventType
     this.warnedRegexMissing = false
     this.warnedInvalidRegex = false
     this.warnedInvalidReplacement = false
   }
 
   get obfuscateConfigRules () {
-    return this.agentRef.init.obfuscate || []
+    const allRules = this.agentRef.init.obfuscate || []
+
+    // If this instance has no specific event type, return all rules
+    if (!this.eventType) return allRules
+
+    // Filter rules to only those that apply to this instance's event type
+    return allRules.filter(rule => {
+      // If rule has no eventFilter, it applies to all events
+      if (!this.#hasValidEventFilter(rule)) {
+        return true
+      }
+      // Otherwise, check if this instance's event type matches the rule's filter
+      return rule.eventFilter.includes(this.eventType)
+    })
   }
 
   /**
@@ -60,6 +80,137 @@ export class Obfuscator {
       }, input)
   }
 
+  /**
+   * Traverses an object and obfuscates all string properties.
+   * This instance will only apply rules that match its configured event type (if any).
+   * For features with mixed event types in their payloads (like generic_events), this will
+   * traverse the object and check each object's eventType property against the rules.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @returns {Object|Array} The modified object
+   */
+  traverseAndObfuscateEvents (obj) {
+    if (!obj || typeof obj !== 'object') return obj
+
+    // If this instance was configured with a specific event type, obfuscate everything
+    // (rules are already filtered in obfuscateConfigRules getter)
+    if (this.eventType) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this))
+      return obj
+    }
+
+    // For generic obfuscators (no specific event types), check individual eventType properties
+    // This path is for features like generic_events that handle multiple event types
+    const eventTypesToObfuscate = new Set()
+    const globalRules = []
+    const eventSpecificRules = []
+
+    this.obfuscateConfigRules.forEach(rule => {
+      if (this.#hasValidEventFilter(rule)) {
+        eventSpecificRules.push(rule)
+        rule.eventFilter.forEach(eventType => eventTypesToObfuscate.add(eventType))
+      } else {
+        globalRules.push(rule)
+      }
+    })
+
+    // Optimization: if ALL rules are global (no event-specific rules exist),
+    // we can just apply all rules to everything without checking eventType properties
+    if (eventSpecificRules.length === 0) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this))
+      return obj
+    }
+
+    // We have a mix of global and event-specific rules:
+    // - Apply event-specific rules only to matching eventTypes
+    // - Apply global rules to ALL event types
+    this.#applyFnWithEventTypeFilter(obj, this.obfuscateString.bind(this), Array.from(eventTypesToObfuscate), globalRules, null)
+    return obj
+  }
+
+  /**
+   * Recursively applies a function to all string properties in an object.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties
+   * @private
+   */
+  #applyFnToAllStrings (obj, fn) {
+    if (!obj || typeof obj !== 'object') return
+
+    Object.keys(obj).forEach(property => {
+      const value = obj[property]
+
+      if (typeof value === 'object' && value !== null) {
+        this.#applyFnToAllStrings(value, fn)
+      } else if (typeof value === 'string') {
+        obj[property] = fn(value)
+      }
+    })
+  }
+
+  /**
+   * Recursively applies a function to string properties based on eventType filtering.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties (applies all rules)
+   * @param {string[]} eventTypes - Array of event types to apply event-specific obfuscation
+   * @param {Array} globalRules - Rules without eventFilter that apply to all events
+   * @param {boolean|null} shouldObfuscate - Track obfuscation state: null = not determined yet, true = obfuscate with all rules, false = obfuscate with global rules only
+   * @private
+   */
+  #applyFnWithEventTypeFilter (obj, fn, eventTypes, globalRules, shouldObfuscate) {
+    if (!obj || typeof obj !== 'object') return
+
+    // Determine the obfuscation state for this object
+    let currentShouldObfuscate = shouldObfuscate
+
+    // Check if this object has an eventType property
+    if ('eventType' in obj && typeof obj.eventType === 'string') {
+      currentShouldObfuscate = eventTypes.includes(obj.eventType)
+    }
+
+    // Process all properties
+    Object.keys(obj).forEach(property => {
+      const value = obj[property]
+
+      if (typeof value === 'object' && value !== null) {
+        // Recursively traverse objects/arrays, passing the current obfuscation state
+        this.#applyFnWithEventTypeFilter(value, fn, eventTypes, globalRules, currentShouldObfuscate)
+      } else if (typeof value === 'string') {
+        if (currentShouldObfuscate === true) {
+          // Apply all rules (both global and event-specific)
+          obj[property] = fn(value)
+        } else if (currentShouldObfuscate === false && globalRules.length > 0) {
+          // Apply only global rules
+          obj[property] = this.#applyRulesToString(value, globalRules)
+        }
+        // If currentShouldObfuscate is null, we haven't found an eventType yet, so don't obfuscate
+      }
+    })
+  }
+
+  /**
+   * Applies specific obfuscation rules to a string.
+   * @param {string} input - The string to obfuscate
+   * @param {Array} rules - The rules to apply
+   * @returns {string} The obfuscated string
+   * @private
+   */
+  #applyRulesToString (input, rules) {
+    if (typeof input !== 'string' || input.trim().length === 0) return input
+
+    const validatedRules = rules.map(rule => this.validateObfuscationRule(rule))
+
+    return validatedRules
+      .filter(ruleValidation => ruleValidation.isValid)
+      .reduce((input, ruleValidation) => {
+        const { rule } = ruleValidation
+        return input.replace(rule.regex, rule.replacement || '*')
+      }, input)
+  }
+
+  #hasValidEventFilter (rule) {
+    return Array.isArray(rule?.eventFilter) && rule.eventFilter.length > 0
+  }
+
   /**
    * Validates an obfuscation rule and provides errors if any are found.
    * @param {ObfuscationRule} rule The rule to validate

package/src/common/wrap/wrap-websocket.js

@@ -8,6 +8,7 @@ import { now } from '../timing/now'
 import { cleanURL } from '../url/clean-url'
 import { gosNREUMOriginals } from '../window/nreum'
 import { subscribeToPageUnload } from '../window/page-visibility'
+import { EVENT_TYPES } from '../constants/events'
 
 const wrapped = {}
 const openWebSockets = new Set() // track all instances to close out metrics on page unload
@@ -37,7 +38,7 @@ export function wrapWebSocket (sharedEE) {
   })
 
   class WrappedWebSocket extends WebSocket {
-    static name = 'WebSocket'
+    static name = EVENT_TYPES.WS
     static toString () { // fake native WebSocket when static class is stringified
       return 'function WebSocket() { [native code] }'
     }

package/src/common/wrap/wrap-xhr.js

@@ -17,7 +17,7 @@ import { warn } from '../util/console'
 import { findTargetsFromStackTrace } from '../v2/utils'
 
 const wrapped = {}
-const XHR_PROPS = ['open', 'send'] // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader'] // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/src/features/ajax/aggregate/gql.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isPureObject } from '../../../common/util/type-check'
@@ -97,3 +97,44 @@ function parseGQLQueryString (gqlQueryString) {
 function validateGQLObject (obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string')
 }
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors (response) {
+  return Array.isArray(response?.errors) &&
+    response.errors.some(err =>
+      err && typeof err === 'object' && typeof err.message === 'string'
+    )
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+export function hasGQLErrors (responseBody) {
+  if (!responseBody) return false
+  try {
+    let parsed = responseBody
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody)
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors)
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed)
+  } catch (err) {
+    return false
+  }
+}

package/src/features/ajax/aggregate/index.js

@@ -6,13 +6,16 @@ import { registerHandler } from '../../../common/event-emitter/register-handler'
 import { stringify } from '../../../common/util/stringify'
 import { handle } from '../../../common/event-emitter/handle'
 import { setDenyList, shouldCollectEvent } from '../../../common/deny-list/deny-list'
-import { AJAX_ID, FEATURE_NAME } from '../constants'
+import { FEATURE_NAME, AJAX_ID } from '../constants'
 import { FEATURE_NAMES } from '../../../loaders/features/features'
 import { AggregateBase } from '../../utils/aggregate-base'
-import { parseGQL } from './gql'
 import { nullable, numeric, getAddStringContext, addCustomAttributes } from '../../../common/serialize/bel-serializer'
 import { gosNREUMOriginals } from '../../../common/window/nreum'
+import { hasGQLErrors, parseGQL } from './gql'
+import { canCapturePayload, isLikelyHumanReadable, parseQueryString, createStringAdders } from '../../../common/payloads/payloads'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
+import { EVENT_TYPES } from '../../../common/constants/events'
 import { generateUuid } from '../../../common/ids/unique-id'
 
 export class Aggregate extends AggregateBase {
@@ -23,6 +26,9 @@ export class Aggregate extends AggregateBase {
     setDenyList(agentRef.runtime.denyList)
     const classThis = this
 
+    // Create obfuscator for AJAX requests
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.AJAX)
+
     if (!agentRef.init.ajax.block_internal) {
       // if the agent is tracking ITSELF, it can spawn endless ajax requests early if they are large from custom attributes, so we just disable early harvest for ajax in this case.
       super.canHarvestEarly = false
@@ -96,6 +102,24 @@ export class Aggregate extends AggregateBase {
       [AJAX_ID]: generateUuid() // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
     }
 
+    event.gql = params.gql = parseGQL({
+      body: ctx.requestBody,
+      query: ctx.parsedOrigin?.search
+    })
+    if (event.gql) event.gql.operationHasErrors = params.gql.operationHasErrors = hasGQLErrors(ctx.responseBody)
+
+    const capturePayloadSetting = this.agentRef.init.ajax.capture_payloads
+    const shouldCapturePayload = canCapturePayload(capturePayloadSetting, params.status, event.gql?.operationHasErrors)
+
+    if (shouldCapturePayload) {
+      // Store raw data; obfuscation and truncation will happen in the serializer
+      params.requestQuery = event.requestQuery = parseQueryString(ctx.parsedOrigin?.search)
+      params.requestHeaders = event.requestHeaders = ctx.requestHeaders
+      params.responseHeaders = event.responseHeaders = ctx.responseHeaders
+      if (isLikelyHumanReadable(ctx.requestHeaders, ctx.requestBody)) params.requestBody = event.requestBody = ctx.requestBody
+      if (isLikelyHumanReadable(ctx.responseHeaders, ctx.responseBody)) params.responseBody = event.responseBody = ctx.responseBody
+    }
+
     if (ctx.dt) {
       event.spanId = ctx.dt.spanId
       event.traceId = ctx.dt.traceId
@@ -104,11 +128,6 @@ export class Aggregate extends AggregateBase {
       )
     }
 
-    // parsed from the AJAX body, looking for operationName param & parsing query for operationType
-    event.gql = params.gql = parseGQL({
-      body: ctx.body,
-      query: ctx.parsedOrigin?.search
-    })
     if (event.gql) this.reportSupportabilityMetric('Ajax/Events/GraphQL/Bytes-Added', stringify(event.gql).length)
 
     /** make a copy of the event for the MFE target if it exists */
@@ -131,7 +150,9 @@ export class Aggregate extends AggregateBase {
 
   serializer (eventBuffer) {
     if (!eventBuffer.length) return
-    const addString = getAddStringContext(this.agentRef.runtime.obfuscator)
+
+    const { addString, addStringWithTruncation } = createStringAdders(getAddStringContext, this.obfuscator)
+
     let payload = 'bel.7;'
 
     let firstTimestamp = 0
@@ -165,15 +186,24 @@ export class Aggregate extends AggregateBase {
       // Since configuration objects (like info) are created new each time they are set, we have to grab the current pointer to the attr object here.
       const jsAttributes = this.agentRef.info.jsAttributes
 
-      // add custom attributes
-      // gql decorators are added as custom attributes to alleviate need for new BEL schema
-      const attrParts = addCustomAttributes({
+      // Regular attributes: obfuscate only
+      const regularAttrs = addCustomAttributes({
         ...(jsAttributes || {}),
-        ...(event.gql || {}),
+        [AJAX_ID]: event[AJAX_ID], // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
         ...(event.targetAttributes || {}), // used to supply the version 2 attributes, either MFE target or duplication attributes for the main agent app
-        [AJAX_ID]: event[AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
+        ...(event.gql || {})
       }, addString)
 
+      // Payload attributes: obfuscate then truncate
+      const payloadAttrs = addCustomAttributes({
+        ...(event.requestBody ? { requestBody: event.requestBody } : {}),
+        ...(event.requestHeaders ? { requestHeaders: event.requestHeaders } : {}),
+        ...(event.requestQuery ? { requestQuery: event.requestQuery } : {}),
+        ...(event.responseBody ? { responseBody: event.responseBody } : {}),
+        ...(event.responseHeaders ? { responseHeaders: event.responseHeaders } : {})
+      }, addStringWithTruncation)
+
+      const attrParts = [...regularAttrs, ...payloadAttrs]
       fields.unshift(numeric(attrParts.length))
 
       insert += fields.join(',')

package/src/features/ajax/constants.js

@@ -5,5 +5,9 @@
 import { FEATURE_NAMES } from '../../loaders/features/features'
 
 export const FEATURE_NAME = FEATURE_NAMES.ajax
-
+export const CAPTURE_PAYLOAD_SETTINGS = {
+  NONE: 'none',
+  FAILURES: 'failures',
+  ALL: 'all'
+}
 export const AJAX_ID = 'ajaxRequest.id'