Firewall constraints for RUM

Real User Monitoring (RUM) uses HTTP technologies to send performance data from client browsers to Dynatrace. To do this, the RUM JavaScript is injected into your application's HTML pages. This tag or code snippet communicates with Dynatrace. However, to fully enable RUM, you must verify the configuration of your firewalls, proxies, and web servers and allow all required data to pass through.

New beacon protocol format in Dynatrace version 1.219+

Starting with version 1.219, Dynatrace provides you with a call-to-action card that allows you to switch all your web applications to the latest beacon format.

All prior beacon versions will reach their end-of-life with Dynatrace version 1.229. If you don’t manage to switch prior to this version, your firewall or security appliance might block beacons because of the format change. Also, if your OneAgents and RUM JavaScript versions are outdated, actions will be dropped and you won't be able to see any monitoring data for your application.

However, you don't need to take action if you set up your application for RUM with Session Replay enabled, or if you ever activated this feature for your app. In this case, you are already using the new beacon protocol.

Actions required to switch to the latest beacon format:

Prepare your firewall or security appliance to allow the new format in case you apply filtering. The difference between the new query strings and the older ones is that the new strings now follow the proper format with an ampersand & as a separator instead of a semi-colon ;, as was used previously.
If you are still using an unsupported version of OneAgent (version 1.167 or earlier), we recommend that you update your OneAgents immediately. Otherwise, the cookies generated by OneAgent will be detected as invalid.

HTTP requests

For RUM to function fully, the following browser requests must be delivered to Dynatrace:

ruxitagentjs_ is the JavaScript tag used for auto-injection—the name of the tag may contain additional information, such as active code modules and/or the version of the tag. Agentless RUM requests use the format ruxitagent_.
/rb_<id> and /bf or /bf_<id> are the monitor signals the RUM JavaScript sends back to Dynatrace.
- The monitor uses query parameters such as app, flavor, format, referer, session, srvid, type, visitID, size, zip, va, tt, and ns.
- The POST body contains the payload. The payload is sent with the content type application/octet-stream.

HTTP headers

RUM uses the following HTTP headers. All of these headers must be able to reach Dynatrace.

Request headers

Header	Purpose
`x-dynatrace`	Used for transaction stitching in HTTP headers. Set by OneAgent to link web servers. Ensure that network components, such as firewalls and routers, are never configured to remove these headers. Incorrect configuration can potentially lead to broken PurePaths. Some network components disable such requests and throw a `403` HTTP error, which is why it is necessary to configure these components to accept the `x-dynatrace` header.
`x-dynatrace-application`	Contains the ID of the RUM application, the cookie domain, and the injection rule (`noop`, `auto`, `before`, or `after`). Also contains the injection pattern when `injectionRule=after` or `injectionRule=before`. Used in case there's some proxy in between a user's browser and the original process that delivers the page.
`x-dynatrace-origin-url`	Preserves the original URL of the request in case of URL rewriting.
`x-dtHealthCheck`
`X-dynaTrace-RequestState`	Tracks the depth of a subpath tree to avoid endless PurePaths.
`x-dtpc`	Identifies proper endpoints for beacon transmission; includes session ID for correlation.
`x-dtreferer`	Contains the referer of the page for an action and improves the correlation results.
`x-dtc`	Contains information for correlation of cross-origin XHRs.
`Cookie`	Sets the `dtCookie` cookie in case the HTTP request doesn't contain any.
`X-Ruxit-Forwarded-For`	Used to track proxy scenarios by the NGINX code module.
`X-ruxit-Apache-ServerNamePorts`	Used by the Apache code module to synchronize service naming with the PHP code module.
`X-ruxit-Disposition`	Used by the IIS code module to declutter .NET code module subpaths.
`Accept-Encoding`	Discarded by the Apache code module during the fine-tuning of HTML injection behavior.
`Content-Encoding`	Discarded during the fine-tuning of HTML injection behavior.
`If-None-Match`	Discarded when caching is suppressed.
`If-Not-Modified-Since`	Discarded when caching is suppressed.
`If-Match`	Modified when caching is suppressed.
`If-Range`	Modified when caching is suppressed.
`traceparent`	Used for W3C tagging.
`tracecontext`	Used for W3C tagging.
`referer`	Contains the address of the previous web page from which a link to the currently requested page was followed.
`user-agent`	Used for browser and OS detection.

Response headers

Header	Purpose
`X-OneAgent-JS-Injection`	Confirms that the RUM JavaScript has been injected to avoid duplicate injection. Has one of the following values: `true`: the injection has been completed. `block`: the injection must not be attempted at this time.
`X-ruxit-JS-Agent`	Confirms that the RUM JavaScript has been injected to avoid duplicate injection. Has one of the following values: `true`: the injection has been completed. `block`: the injection must not be attempted at this time.
`x-dtHealthCheck`	Set for responses to special requests. Contains the result of the RUM health check—potential reasons why there is or might be a problem with the injection of the RUM JavaScript. To perform a health check, a page must be requested with the `dtHealthCheck` user agent.
`x-dtAgentId`	If the RUM health check is enabled, any involved OneAgent code module adds its ID here. Set for responses to special requests.
`x-dtInjectedServlet`	Contains the fully qualified name of the injected servlet or filter.
`Set-Cookie`	Sets the session state cookie of OneAgent.
`ETag`	OneAgent appends a custom string to the original `ETag` response header to track the changes in the application configuration.
`Last-modified`	If the `ETag` response header is manipulated, OneAgent also subtracts 1 second from the original value of this header. Set for responses to special requests.
`Content-Length`	Adapted upon HTML injection. Set for responses to special requests.
`Vary`	Adapted during HTML injection into compressed responses. Set for responses to special requests.
`Content-Encoding`	Adapted during HTML injection into compressed responses.
`Content-Type`	Set for responses to special requests.
`Access-Control-Allow-Origin`	Set for responses to special requests.
`Cache-Control`	Set for responses to special requests.

Cookies

RUM uses the following cookies. All of these must be able to reach Dynatrace. See the Cookies page for more information on how Dynatrace uses cookies.

Cookie	Max size	Purpose
`dtCookie`		Tracks a visit across multiple requests.
`dtLatC`	5 B	Measures server latency for performance monitoring.
`dtPC`	54 B	Required to identify proper endpoints for beacon transmission; includes session ID for correlation.
`dtSa`	max URL length	Intermediate store for page-spanning actions
`rxVisitor`	45 B	Visitor ID to correlate sessions
`rxvt`	27 B	Session timeout

Mobile RUM

OneAgent for Mobile uses the x-dynatrace header for tagging HTTP requests. In hybrid setups, the dtAdk cookie is used to join hybrid sessions and the dtAdkSettings cookie is used for syncing settings between OneAgent for Mobile and the RUM JavaScript.

/mbeacon is the monitor signal that OneAgent for Mobile sends back to Dynatrace if the data is transferred through ActiveGate. If data is sent to another OneAgent, the monitor signal is /dtmb.