topic Re: Real User API Security in Real User Monitoring

Real User API Security

Matthias-Versio — Mon, 23 Aug 2021 08:12:54 GMT

How is the abuse of the Real User Monitoring API secured?
From my point of view, the RUM data could currently be quite easily contaminated by means of external requests.

Re: Real User API Security

andreas_grabner — Mon, 23 Aug 2021 15:26:21 GMT

Want to add some additional context as Matthias and I initially discussed this question via email and I asked him to post it here as I didnt know the answer either:

"Which mechanisms exist in the Dynatrace RUM API to prevent any misusage or tampering, e.g: sending bogus data or modifying data that is collected?"

Re: Real User API Security

Philipp_Kastner — Tue, 24 Aug 2021 10:29:42 GMT

Hi Matthias,

thanks for reaching out. We do validate the RUM data. However, if someone simulates valid data it is in theory possible to send bogus/fake data. I believe there isn't much we can do about it for real user monitoring of public pages.
This is a problem also other analytics solutions face.

That said, there is always the option to only allow traffic from trusted sources or block suspicious sources on the network/firewall level.

Kind regards,

Philipp

Re: Real User API Security

Matthias-Versio — Tue, 24 Aug 2021 12:02:48 GMT

Hello Phillip,

thank you for your timely feedback.

That's exactly how I thought it would be.

Regards

Matthias

Re: Real User API Security

fstekelenburg — Fri, 03 Dec 2021 09:19:35 GMT

Perhaps, as also suggested in the linked page, the RUM agent could pull a hash token from the server (activegate) and pass it along. And if that hash is based on the environment ID and timestamp, this could be verified upon reception of data?