@newrelic/browser-agent 1.316.0 → 1.317.0

package/src/features/ajax/instrument/index.js

@@ -14,7 +14,7 @@ import { parseUrl } from '../../../common/url/parse-url'
 import { DT } from './distributed-tracing'
 import { responseSizeFromXhr } from './response-size'
 import { InstrumentBase } from '../../utils/instrument-base'
-import { FEATURE_NAME } from '../constants'
+import { CAPTURE_PAYLOAD_SETTINGS, FEATURE_NAME } from '../constants'
 import { FEATURE_NAMES } from '../../../loaders/features/features'
 import { SUPPORTABILITY_METRIC } from '../../metrics/constants'
 import { now } from '../../../common/timing/now'
@@ -27,6 +27,7 @@ var handlersLen = handlers.length
 var origRequest = gosNREUMOriginals().o.REQ
 var origXHR = gosNREUMOriginals().o.XHR
 const NR_CAT_HEADER = 'X-NewRelic-App-Data'
+const INTERNAL_ERROR = 'internal-error'
 
 export class Instrument extends InstrumentBase {
   static featureName = FEATURE_NAME
@@ -62,16 +63,18 @@ export class Instrument extends InstrumentBase {
     wrapFetch(this.ee, agentRef)
     wrapXhr(this.ee, agentRef)
     subscribeToEvents(agentRef, this.ee, this.handler, this.dt)
-
     this.importAggregator(agentRef, () => import(/* webpackChunkName: "ajax-aggregate" */ '../aggregate/index.js'))
   }
 }
 
 function subscribeToEvents (agentRef, ee, handler, dt) {
+  const shouldInterceptPayloads = [CAPTURE_PAYLOAD_SETTINGS.ALL, CAPTURE_PAYLOAD_SETTINGS.FAILURES].includes(agentRef.init.ajax?.capture_payloads)
+
   ee.on('new-xhr', onNewXhr)
   ee.on('open-xhr-start', onOpenXhrStart)
   ee.on('open-xhr-end', onOpenXhrEnd)
   ee.on('send-xhr-start', onSendXhrStart)
+  ee.on('setRequestHeader-xhr-start', onSetRequestHeader)
   ee.on('xhr-cb-time', onXhrCbTime)
   ee.on('xhr-load-added', onXhrLoadAdded)
   ee.on('xhr-load-removed', onXhrLoadRemoved)
@@ -147,6 +150,14 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
     }
   }
 
+  function onSetRequestHeader (args, xhr) {
+    // args[0] = header name, args[1] = header value
+    if (shouldInterceptPayloads && args.length >= 2) {
+      this.requestHeaders ??= {}
+      this.requestHeaders[args[0].toLowerCase()] = args[1]
+    }
+  }
+
   function onSendXhrStart (args, xhr) {
     var metrics = this.metrics
     var data = args[0]
@@ -159,7 +170,7 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
 
     this.startTime = now()
 
-    this.body = data
+    this.requestBody = data
 
     this.listener = function (evt) {
       try {
@@ -169,7 +180,7 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
         if (evt.type !== 'load' || ((context.called === context.totalCbs) && (context.onloadCalled || typeof (xhr.onload) !== 'function') && typeof context.end === 'function')) context.end(xhr)
       } catch (e) {
         try {
-          ee.emit('internal-error', [e])
+          ee.emit(INTERNAL_ERROR, [e])
         } catch (err) {
           // do nothing
         }
@@ -321,9 +332,29 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
     const method = ('' + ((target && target instanceof origRequest && target.method) ||
       opts.method || 'GET')).toUpperCase()
     this.params.method = method
-    this.body = opts.body
 
-    this.txSize = dataSize(opts.body) || 0
+    this.txSize = dataSize(opts.body || (target?.body)) || 0
+
+    // Capture request headers
+    try {
+      var headers = opts.headers || (target?.headers)
+      if (shouldInterceptPayloads && headers) {
+        this.requestHeaders ??= {}
+        if (headers instanceof Headers) {
+          headers.forEach(function (value, key) {
+            this.requestHeaders[key.toLowerCase()] = value
+          }.bind(this))
+        } else if (typeof headers === 'object') {
+          for (var key in headers) {
+            this.requestHeaders[key.toLowerCase()] = headers[key]
+          }
+        }
+      }
+    } catch (e) {
+      // Silently fail if we can't access headers
+    }
+
+    this.requestBody = opts.body || (target?.body)
   }
 
   // we capture failed call as status 0, the actual error is ignored
@@ -335,20 +366,47 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
 
     this.params.status = res ? res.status : 0
 
-    // convert rxSize to a number
-    let responseSize
-    if (typeof this.rxSize === 'string' && this.rxSize.length > 0) {
-      responseSize = +this.rxSize
+    const finishAndReport = () => {
+      // convert rxSize to a number - handle both string (from content-length header) and number (from fallback)
+      const num = +this.rxSize
+      const responseSize = this.rxSize != null && !isNaN(num) ? num : undefined
+
+      const metrics = {
+        txSize: this.txSize,
+        rxSize: responseSize,
+        duration: this.endTime - this.startTime
+      }
+
+      const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch']
+      this.targets.forEach(target => reportToAgg(payload, this, target))
     }
 
-    const metrics = {
-      txSize: this.txSize,
-      rxSize: responseSize,
-      duration: now() - this.startTime
+    /** Since accessing fetch bodies is an async process, these are
+     * reasonable conditions to check to not do needless extra work */
+    if (!res || !shouldInterceptPayloads) {
+      finishAndReport()
+      return
     }
 
-    const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch']
-    this.targets.forEach(target => reportToAgg(payload, this, target))
+    // Clone the response to read the body without consuming the original
+    res.clone().text().then((text) => {
+      this.responseBody = text
+      // Use captured payload size as fallback if content-length header was missing or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!this.rxSize || this.rxSize === '0' || this.rxSize === 0) && text !== undefined && this.params.status !== 0) {
+        this.rxSize = dataSize(text)
+      }
+      if (res?.headers) {
+        this.responseHeaders = {}
+        res.headers.forEach(function (value, key) {
+          this.responseHeaders[key.toLowerCase()] = value
+        }.bind(this))
+      }
+    }).catch((err) => {
+      ee.emit(INTERNAL_ERROR, [err])
+    }).finally(() => {
+      finishAndReport()
+    })
   }
 
   // Create report for XHR request that has finished
@@ -365,7 +423,7 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
     if (params.aborted) return
     if (hasUndefinedHostname(params)) return // don't bother with XHR of url with no hostname
 
-    metrics.duration = now() - this.startTime
+    metrics.duration = this.endTime - this.startTime
     if (!this.loadCaptureCalled && xhr.readyState === 4) {
       captureXhrData(this, xhr)
     } else if (params.status == null) {
@@ -375,6 +433,27 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
     // Always send cbTime, even if no noticeable time was taken.
     metrics.cbTime = this.cbTime
 
+    if (shouldInterceptPayloads) {
+      try {
+        this.responseBody = xhr.responseText
+      } catch (e) {
+        this.responseBody = xhr.response
+      }
+
+      // Use captured payload size as fallback if not already determined or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!metrics.rxSize || metrics.rxSize === 0) && this.responseBody !== undefined && params.status !== 0) {
+        const size = dataSize(this.responseBody)
+        if (size !== undefined) metrics.rxSize = size
+      }
+
+      try {
+        this.responseHeaders = parseResponseHeaders(xhr.getAllResponseHeaders())
+      } catch (err) {
+        ee.emit(INTERNAL_ERROR, [err])
+      }
+    }
+
     const payload = [params, metrics, this.startTime, this.endTime, 'xhr']
     this.targets.forEach(target => reportToAgg(payload, this, target))
   }
@@ -387,7 +466,8 @@ function subscribeToEvents (agentRef, ee, handler, dt) {
     ctx.params.status = xhr.status
 
     var size = responseSizeFromXhr(xhr, ctx.lastSize)
-    if (size) ctx.metrics.rxSize = size
+    // Don't set rxSize for network errors (status 0)
+    if (size !== undefined && xhr.status !== 0) ctx.metrics.rxSize = size
 
     if (ctx.sameOrigin && xhr.getAllResponseHeaders().indexOf(NR_CAT_HEADER) >= 0) {
       var header = xhr.getResponseHeader(NR_CAT_HEADER)
@@ -414,4 +494,20 @@ function addUrl (ctx, url) {
   ctx.sameOrigin = parsed.sameOrigin
 }
 
+function parseResponseHeaders (headerStr) {
+  const headers = {}
+  if (!headerStr) return headers
+
+  headerStr.split('\r\n').forEach(function (line) {
+    const separatorIndex = line.indexOf(': ')
+    if (separatorIndex > 0) {
+      const name = line.substring(0, separatorIndex)
+      const value = line.substring(separatorIndex + 2)
+      headers[name.toLowerCase()] = value
+    }
+  })
+
+  return headers
+}
+
 export const Ajax = Instrument

package/src/features/generic_events/aggregate/index.js

@@ -10,10 +10,11 @@ import { AggregateBase } from '../../utils/aggregate-base'
 import { warn } from '../../../common/util/console'
 import { now } from '../../../common/timing/now'
 import { registerHandler } from '../../../common/event-emitter/register-handler'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { UserActionsAggregator } from './user-actions/user-actions-aggregator'
 import { isIFrameWindow } from '../../../common/dom/iframe'
 import { isPureObject } from '../../../common/util/type-check'
+import { EVENT_TYPES } from '../../../common/constants/events'
 import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
 
 export class Aggregate extends AggregateBase {
@@ -24,6 +25,10 @@ export class Aggregate extends AggregateBase {
     super(agentRef, FEATURE_NAME)
     this.referrerUrl = (isBrowserScope && document.referrer) ? cleanURL(document.referrer) : undefined
 
+    // Create generic obfuscator (no specific event types) since this feature handles multiple event types
+    // Will check each event's eventType property at runtime against obfuscation rules
+    this.obfuscator = new Obfuscator(agentRef)
+
     this.waitForFlags(['ins']).then(([ins]) => {
       if (!ins) {
         this.blocked = true
@@ -46,7 +51,7 @@ export class Aggregate extends AggregateBase {
         registerHandler('api-addPageAction', (timestamp, name, attributes, target) => {
           this.addEvent({
             ...attributes,
-            eventType: 'PageAction',
+            eventType: EVENT_TYPES.PA,
             timestamp: this.#toEpoch(timestamp),
             timeSinceLoad: timestamp / 1000,
             actionName: name,
@@ -73,7 +78,7 @@ export class Aggregate extends AggregateBase {
 
               aggregatedUserAction.targets.forEach(mfeTarget => {
                 const userActionEvent = {
-                  eventType: 'UserAction',
+                  eventType: EVENT_TYPES.UA,
                   timestamp: this.#toEpoch(timeStamp),
                   action: type,
                   actionCount: aggregatedUserAction.count,
@@ -152,7 +157,7 @@ export class Aggregate extends AggregateBase {
                     const detailObj = agentRef.init.performance.capture_detail ? createDetailAttrs(entry.detail) : {}
                     this.addEvent({
                       ...detailObj,
-                      eventType: 'BrowserPerformance',
+                      eventType: EVENT_TYPES.BP,
                       timestamp: this.#toEpoch(entry.startTime),
                       entryName: entry.name,
                       entryDuration: entry.duration,
@@ -217,7 +222,7 @@ export class Aggregate extends AggregateBase {
             this.reportSupportabilityMetric('Generic/Performance/Resource/Seen')
             const event = {
               ...entryObject,
-              eventType: 'BrowserPerformance',
+              eventType: EVENT_TYPES.BP,
               timestamp: this.#toEpoch(entryObject.startTime),
               entryName: cleanURL(name),
               entryDuration: duration,
@@ -236,7 +241,7 @@ export class Aggregate extends AggregateBase {
 
         const event = {
           ...customAttributes,
-          eventType: 'BrowserPerformance',
+          eventType: EVENT_TYPES.BP,
           timestamp: this.#toEpoch(start),
           entryName: n,
           entryDuration: duration,
@@ -250,7 +255,7 @@ export class Aggregate extends AggregateBase {
         registerHandler('ws-complete', (nrData) => {
           const event = {
             ...nrData,
-            eventType: 'WebSocket',
+            eventType: EVENT_TYPES.WS,
             timestamp: this.#toEpoch(nrData.timestamp),
             openedAt: this.#toEpoch(nrData.openedAt),
             closedAt: this.#toEpoch(nrData.closedAt)
@@ -266,7 +271,7 @@ export class Aggregate extends AggregateBase {
       if (!agentRef.init.feature_flags.includes('no_spv')) {
         registerHandler('spv', (evt) => {
           this.addEvent({
-            eventType: 'SecurityPolicyViolation',
+            eventType: EVENT_TYPES.SPV,
             timestamp: this.#toEpoch(evt.timeStamp),
             blockedUri: evt.blockedURI,
             documentUri: evt.documentURI,
@@ -335,7 +340,7 @@ export class Aggregate extends AggregateBase {
   }
 
   serializer (eventBuffer) {
-    return applyFnToProps({ ins: eventBuffer }, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')
+    return this.obfuscator.traverseAndObfuscateEvents({ ins: eventBuffer })
   }
 
   queryStringsBuilder () {

package/src/features/generic_events/constants.js

@@ -1,7 +1,8 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
+import { EVENT_TYPES } from '../../common/constants/events'
 import { FEATURE_NAMES } from '../../loaders/features/features'
 
 export const FEATURE_NAME = FEATURE_NAMES.genericEvents
@@ -14,7 +15,7 @@ export const RAGE_CLICK_THRESHOLD_MS = 1000
 
 export const FRUSTRATION_TIMEOUT_MS = 2000
 
-export const RESERVED_EVENT_TYPES = ['PageAction', 'UserAction', 'BrowserPerformance']
+export const RESERVED_EVENT_TYPES = [EVENT_TYPES.PA, EVENT_TYPES.UA, EVENT_TYPES.BP]
 
 export const FEATURE_FLAGS = {
   RESOURCES: 'experimental.resources',

package/src/features/jserrors/aggregate/format-stack-trace.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -10,7 +10,7 @@ export function formatStackTrace (stackLines) {
   return truncateStackLines(stackLines).replace(stripNewlinesRegex, '')
 }
 
-// takes array of stack lines and returns string with top 50 and buttom 50 lines
+// takes array of stack lines and returns string with top 50 and bottom 50 lines
 function truncateStackLines (stackLines) {
   var stackString
   if (stackLines.length > 100) {
@@ -26,5 +26,5 @@ function truncateStackLines (stackLines) {
 
 // truncates stack string to limit what is sent to backend
 export function truncateSize (stackString) {
-  return (stackString.length > MAX_STACK_TRACE_LENGTH) ? stackString.substr(0, MAX_STACK_TRACE_LENGTH) : stackString
+  return stackString.length > MAX_STACK_TRACE_LENGTH ? stackString.substr(0, MAX_STACK_TRACE_LENGTH) : stackString
 }

package/src/features/jserrors/aggregate/index.js

@@ -17,11 +17,12 @@ import { FEATURE_NAME } from '../constants'
 import { FEATURE_NAMES } from '../../../loaders/features/features'
 import { AggregateBase } from '../../utils/aggregate-base'
 import { now } from '../../../common/timing/now'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { evaluateInternalError } from './internal-errors'
 import { getRegisteredTargetsFromFilename, getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
 import { buildCauseString } from './cause-string'
 import { ShortCircuit } from '../../../common/util/short-circuit'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 /**
  * @typedef {import('./compute-stack-trace.js').StackInfo} StackInfo
@@ -39,6 +40,10 @@ export class Aggregate extends AggregateBase {
     this.pageviewReported = {}
     this.errorOnPage = false
 
+    // Create obfuscators for each event type this feature handles
+    this.errorObfuscator = new Obfuscator(agentRef, EVENT_TYPES.JSE)
+    this.xhrObfuscator = new Obfuscator(agentRef, EVENT_TYPES.AJAX)
+
     register('err', this.processError.bind(this), this.featureName, this.ee)
     register('ierr', this.processError.bind(this), this.featureName, this.ee)
     register('returnJserror', (jsErrorEvent, softNavAttrs) => this.#storeJserrorForHarvest(jsErrorEvent, softNavAttrs), this.featureName, this.ee)
@@ -55,7 +60,11 @@ export class Aggregate extends AggregateBase {
   }
 
   serializer (aggregatorTypeToBucketsMap) {
-    return applyFnToProps(aggregatorTypeToBucketsMap, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')
+    return {
+      err: this.errorObfuscator.traverseAndObfuscateEvents(aggregatorTypeToBucketsMap.err),
+      ierr: this.errorObfuscator.traverseAndObfuscateEvents(aggregatorTypeToBucketsMap.ierr),
+      xhr: this.xhrObfuscator.traverseAndObfuscateEvents(aggregatorTypeToBucketsMap.xhr)
+    }
   }
 
   queryStringsBuilder (aggregatorTakeReturnedData) {
@@ -258,7 +267,7 @@ export class Aggregate extends AggregateBase {
       params.stack_trace = truncateSize(stackInfo.stackString)
       this.observedAt[bucketHash] = Math.floor(this.agentRef.runtime.timeKeeper.correctRelativeTimestamp(time))
     } else {
-      params.browser_stack_hash = stringHashCode(stackInfo.stackString)
+      params.browser_stack_hash = stringHashCode(truncateSize(stackInfo.stackString))
     }
     params.releaseIds = stringify(this.agentRef.runtime.releaseIds)
 

package/src/features/logging/aggregate/index.js

@@ -9,11 +9,12 @@ import { AggregateBase } from '../../utils/aggregate-base'
 import { FEATURE_NAME, LOGGING_EVENT_EMITTER_CHANNEL, LOG_LEVELS, LOGGING_MODE } from '../constants'
 import { Log } from '../shared/log'
 import { isValidLogLevel } from '../shared/utils'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { SESSION_EVENT_TYPES, SESSION_EVENTS } from '../../../common/session/constants'
 import { ABORT_REASONS } from '../../session_replay/constants'
 import { canEnableSessionTracking } from '../../utils/feature-gates'
 import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 const LOGGING_EVENT = 'Logging/Event/'
 
@@ -31,6 +32,9 @@ export class Aggregate extends AggregateBase {
     this.harvestOpts.raw = true
     super.customAttributesAreSeparate = true
 
+    // Create obfuscator for log entries
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.LOG)
+
     // The SessionEntity class can emit a message indicating the session was cleared and reset (expiry, inactivity). This feature must abort and never resume if that occurs.
     this.ee.on(SESSION_EVENTS.RESET, () => {
       this.abort(ABORT_REASONS.RESET)
@@ -119,7 +123,7 @@ export class Aggregate extends AggregateBase {
       common: {
         /** Attributes in the `common` section are added to `all` logs generated in the payload */
         attributes: {
-          ...(applyFnToProps(this.agentRef.info.jsAttributes, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')),
+          ...(this.obfuscator.traverseAndObfuscateEvents(this.agentRef.info.jsAttributes)),
           ...(this.harvestEndpointVersion === 1 && {
             'entity.guid': this.agentRef.runtime.appMetadata.agents[0].entityGuid,
             appId: this.agentRef.info.applicationID
@@ -139,10 +143,7 @@ export class Aggregate extends AggregateBase {
         }
       },
       /** logs section contains individual unique log entries */
-      logs: applyFnToProps(
-        eventBuffer,
-        this.obfuscator.obfuscateString.bind(this.obfuscator), 'string'
-      )
+      logs: this.obfuscator.traverseAndObfuscateEvents(eventBuffer)
     }]
   }
 

package/src/features/metrics/aggregate/index.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { registerHandler } from '../../../common/event-emitter/register-handler'
@@ -12,6 +12,7 @@ import { isBrowserScope, isWorkerScope } from '../../../common/constants/runtime
 import { AggregateBase } from '../../utils/aggregate-base'
 import { isIFrameWindow } from '../../../common/dom/iframe'
 import { evaluateHarvestMetadata } from './harvest-metadata'
+import { Obfuscator } from '../../../common/util/obfuscate'
 // import { WEBSOCKET_TAG } from '../../../common/wrap/wrap-websocket'
 // import { handleWebsocketEvents } from './websocket-detection'
 
@@ -21,6 +22,9 @@ export class Aggregate extends AggregateBase {
     super(agentRef, FEATURE_NAME)
     this.harvestOpts.aggregatorTypes = ['cm', 'sm'] // the types in EventAggregator this feature cares about
 
+    // Create a generic obfuscator for checking if rules are configured
+    this.obfuscator = new Obfuscator(agentRef)
+
     /** all the harvest metadata metrics need to be evaluated simulataneously at unload time so just temporarily buffer them and dont make SMs immediately from the data */
     this.harvestMetadata = {}
     this.harvestOpts.beforeUnload = () => {

package/src/features/page_view_event/aggregate/index.js

@@ -15,11 +15,12 @@ import { firstPaint } from '../../../common/vitals/first-paint'
 import { timeToFirstByte } from '../../../common/vitals/time-to-first-byte'
 import { now } from '../../../common/timing/now'
 import { TimeKeeper } from '../../../common/timing/time-keeper'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { send } from '../../../common/harvest/harvester'
 import { FEATURE_NAMES, FEATURE_TO_ENDPOINT } from '../../../loaders/features/features'
 import { getSubmitMethod } from '../../../common/util/submit-data'
 import { webdriverDetected } from '../../../common/util/webdriver-detection'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 export class Aggregate extends AggregateBase {
   static featureName = CONSTANTS.FEATURE_NAME
@@ -34,6 +35,9 @@ export class Aggregate extends AggregateBase {
     this.firstByteToDomContent = 0 // our "dom processing" duration
     this.retries = 0
 
+    // Create obfuscator for page view events
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.PVE)
+
     agentRef.runtime.timeKeeper = new TimeKeeper(agentRef.runtime.session)
 
     if (isBrowserScope) {
@@ -83,7 +87,7 @@ export class Aggregate extends AggregateBase {
 
     if (this.agentRef.runtime.session) queryParameters.fsh = Number(this.agentRef.runtime.session.isNew) // "first session harvest" aka RUM request or PageView event of a session
 
-    let body = applyFnToProps({ ja: { ...customAttributes, webdriverDetected } }, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')
+    let body = this.obfuscator.traverseAndObfuscateEvents({ ja: { ...customAttributes, webdriverDetected } })
 
     if (globalScope.performance) {
       const navTimingEntry = getNavigationEntry()

package/src/features/page_view_timing/aggregate/index.js

@@ -9,6 +9,7 @@ import { handle } from '../../../common/event-emitter/handle'
 import { FEATURE_NAME } from '../constants'
 import { FEATURE_NAMES } from '../../../loaders/features/features'
 import { AggregateBase } from '../../utils/aggregate-base'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { cumulativeLayoutShift } from '../../../common/vitals/cumulative-layout-shift'
 import { firstContentfulPaint } from '../../../common/vitals/first-contentful-paint'
 import { firstPaint } from '../../../common/vitals/first-paint'
@@ -21,6 +22,7 @@ import { eventOrigin } from '../../../common/util/event-origin'
 import { loadTime } from '../../../common/vitals/load-time'
 import { webdriverDetected } from '../../../common/util/webdriver-detection'
 import { cleanURL } from '../../../common/url/clean-url'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME
@@ -36,6 +38,9 @@ export class Aggregate extends AggregateBase {
 
     super.customAttributesAreSeparate = true
 
+    // Create obfuscator for page view timing events
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.PVT)
+
     registerHandler('docHidden', msTimestamp => this.endCurrentSession(msTimestamp), this.featureName, this.ee)
     // Add the time of _window pagehide event_ firing to the next PVT harvest == NRDB windowUnload attr:
     registerHandler('winPagehide', msTimestamp => this.addTiming('unload', msTimestamp, null), this.featureName, this.ee)
@@ -141,7 +146,7 @@ export class Aggregate extends AggregateBase {
   // serialize array of timing data
   serializer (eventBuffer) {
     if (!eventBuffer?.length) return ''
-    var addString = getAddStringContext(this.agentRef.runtime.obfuscator)
+    var addString = getAddStringContext(this.obfuscator)
 
     var payload = 'bel.6;'
 

package/src/features/session_replay/aggregate/index.js

@@ -19,9 +19,11 @@ import { stringify } from '../../../common/util/stringify'
 import { stylesheetEvaluator } from '../shared/stylesheet-evaluator'
 import { now } from '../../../common/timing/now'
 import { MAX_PAYLOAD_SIZE } from '../../../common/constants/agent-constants'
+import { EVENT_TYPES } from '../../../common/constants/events'
 import { cleanURL } from '../../../common/url/clean-url'
 import { canEnableSessionTracking } from '../../utils/feature-gates'
 import { PAUSE_REPLAY } from '../../../loaders/api/constants'
+import { Obfuscator } from '../../../common/util/obfuscate'
 
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME
@@ -30,6 +32,10 @@ export class Aggregate extends AggregateBase {
   // pass the recorder into the aggregator
   constructor (agentRef, args) {
     super(agentRef, FEATURE_NAME)
+
+    // Create obfuscator for session replay query params
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.SR)
+
     /** Set once the recorder has fully initialized after flag checks and sampling */
     this.initialized = false
     /** Set once the feature has been "aborted" to prevent other side-effects from continuing */
@@ -303,7 +309,7 @@ export class Aggregate extends AggregateBase {
     return {
       qs: {
         browser_monitoring_key: this.agentRef.info.licenseKey,
-        type: 'SessionReplay',
+        type: EVENT_TYPES.SR,
         app_id: this.agentRef.info.applicationID,
         protocol_version: '0',
         timestamp: firstTimestamp,

package/src/features/session_trace/aggregate/index.js

@@ -9,9 +9,10 @@ import { TraceStorage } from './trace/storage'
 import { obj as encodeObj } from '../../../common/url/encode'
 import { globalScope } from '../../../common/constants/runtime'
 import { MODE, SESSION_EVENTS } from '../../../common/session/constants'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { cleanURL } from '../../../common/url/clean-url'
 import { warn } from '../../../common/util/console'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 /** Reserved room for query param attrs */
 const QUERY_PARAM_PADDING = 5000
@@ -22,6 +23,9 @@ export class Aggregate extends AggregateBase {
     super(agentRef, FEATURE_NAME)
     this.harvestOpts.raw = true
 
+    // Create obfuscator for session trace nodes
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.ST)
+
     /** Tied to the entitlement flag response from BCS.  Will short circuit operations of the agg if false  */
     this.entitled = undefined
     /** A flag used to decide if the 30 node threshold should be ignored on the first harvest to ensure sending on the first payload */
@@ -114,7 +118,7 @@ export class Aggregate extends AggregateBase {
   serializer (stns) {
     if (!stns.length) return // there are no processed nodes
     this.everHarvested = true
-    return applyFnToProps(stns, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')
+    return this.obfuscator.traverseAndObfuscateEvents(stns)
   }
 
   queryStringsBuilder (stns) {