Browser monitors: Missing XHR actions for third-party iframes

[nandini_balakri]

Summary

After the transition of the Dynatrace Synthetic Recorder to Manifest V3 (MV3), JavaScript injection in Browser Monitors is now based on the Fetch API. As a result, you may notice that XHR actions from third‑party iFrames (iFrames loading a different domain than the main page) are missing from the waterfall analysis, even when you've enabled Capture performance metrics for pages loaded in frames in the Advanced setup of browser monitor settings .

This article explains why XHR actions from third‑party iFrames are missing in Dynatrace Browser Monitors and shows the additional configuration required to capture them again.

• Summary
• Why Are XHR Actions from Third‑Party iFrames Missing?
• How to Capture Missing XHR Actions from Third‑Party iFrames
• Required Configuration
• Important Notes
• Verification
• Frequently Asked Questions
• Why does this only affect third‑party iFrames?
• Does this affect first‑party iFrames?
• Is this behavior specific to MV3?
• What's Next
• Related reading

Why Are XHR Actions from Third‑Party iFrames Missing?

With the move to Manifest V3, Dynatrace Synthetic Monitoring now relies on the browser’s Fetch API–based injection model. Chromium’s site isolation behavior limits visibility into network requests initiated from third‑party iFrames.

Because of this, XHR actions from those iFrames are excluded unless an additional Chromium startup flag is explicitly enabled.

How to Capture Missing XHR Actions from Third‑Party iFrames

To capture XHR actions from third-party iframes, you must enable

enable an additional Chromium startup flag, disable-site-isolation-trials, in Browser Monitor script mode.

Required Configuration

Add the following flag to chromiumStartupFlags:

{
    "configuration": {
        "chromiumStartupFlags": {
            "disable-web-security": false,
            "disable-site-isolation-trials": true
        },

Important Notes

• By default this flag is not shown in the script, but it has the default value of disable-site-isolation-trials is false. 
• Do not overwrite existing Chromium flags
  • You may already have flags such as:
    • disable-web-security
    • ignore-certificate-errors
  • If so, keep them and only add or update disable-site-isolation-trials

Enabling this flag allows Dynatrace Browser Monitors to capture XHR actions originating from third‑party iFrames.

Verification

After applying the configuration:

1. Save the Browser Monitor
2. Execute the monitor on demand
3. Review the waterfall analysis
4. Confirm that XHR actions from third‑party iFrames are now visible

If XHR actions are still missing, double‑check that:

• Capture performance metrics for pages loaded in frames in the Advanced setup of browser monitor settings.
• No Chromium flags were accidentally removed.
• The requests originate from third‑party iFrames (different domain).

Frequently Asked Questions

Why does this only affect third‑party iFrames?

Chromium site isolation restricts access to network activity across different domains. Third‑party iFrames fall under these restrictions unless site isolation trials are disabled. 

Does this affect first‑party iFrames?

No. XHR actions from first‑party iFrames (same domain as the main page) continue to be captured without additional configuration. 

Is this behavior specific to MV3?

Yes. This behavior was introduced after the Synthetic Recorder transitioned to Manifest V3 and the Fetch API–based injection model.

What's Next

If enabling disable-site-isolation-trials doesn’t resolve the issue, open a support chat and provide:

• A link to the Browser Monitor
• Confirmation that the flag is enabled
• Example URLs of affected third‑party iFrames

Related reading

📖  Synthetic Troubleshooting Map

📖  Script mode for Browser Monitor configuration

📖  (Classic) Configure Browser monitors

📖  (Synthetic app) Configure Browser Monitors

[thecutch22]

The following flag is by default appearing in all scripts in my environment: "disable-web-security": false ... I assume this is why this fix still doesn't work for me, because it is overwriting.

Even when I try to manually remove this flag from a script, it immediately gets added back in. How would I stop that flag from automatically being added?

Thank you!

[HannahM]

@thecutch22 you need to have both, please try

{
    "configuration": {
        "chromiumStartupFlags": {
            "disable-site-isolation-trials": true,
            "disable-web-security": false
        },

If you want to enable disable-web-security instead, you should use "

disable-web-security": true

[GerardoAud]

Hi @HannahM,
I am facing similar issue. Sometimes I noticed that on this steps I do not have full waterfall.

Over the past week, I observed that the waterfall data was fully captured only once, as shown below: 

However, for other similar runs during the same period, the waterfall data was missing, as illustrated here:

I would appreciate any insights or recommendations on how to resolve this issue. Are there specific configurations or conditions that could be affecting the consistent capture of waterfall data?

Thanks in advance!

[HannahM]

Hi Gerardo, 

this is more easily investigated by looking at the monitor itself. I would recommend opening a chat or support ticket for this. 

That said, if you have already added the settings on this page, I would try changing the wait for this page. While testing, you could try 'Wait for a specific period time' and maybe set it to 60s. Then you can quickly see if changing the wait strategy would help. I don't recommend leaving it as a time wait, usually wait for a specified element is a better option, as you can then choose an element that you know appears later in the page loading. 

You could also check if there is a service worker on the page, you can either open the site in one tab and in the next tab open chrome://inspect/#service-workers which will show you the active service workers, or if you click F12 and open devTools a search for "ngsw" usually reveals if there is one. If there is one, I recommend applying the "dsw=1" custom configuration to disable the service worker, as described here.

It can also be related to the frameworks or JS Agent settings. So you could test each of the settings in Monitor> Edit> Advanced Setup> Enable custom RUM JavaScript Settings and see if any help. 

[GerardoAud]

Hi @HannahM 

Hi,

Thank you for the detailed advice. I tried the steps you suggested, but I still have the same issue. I can't see the CSS element/image that I should be seeing. You can check the screenshot below for more details.

[HannahM]

That's a shame. Please open a chat to investigate this further. Thanks

[Jennifer]

Is there a way to add these flags to multiple monitors at once via the API or only through JSON script editing?  We have many monitored apps using iframe and this would be helpful to add.

[HannahM]

You can use the Synthetic Monitors API to update this.