Wrong time reported for secure connection start

[Abinet18]

As part of navigation and resource events, secureConnectionStart is added to the spans generated by instrumentations like document_load, xhr and fetch. The value reported by browser is 0 when the page is not secure (http) but the instrumentation reports a value that is lower than fetchStart (probably using timeOrigin) , which can result in wrong metrics by backend. Can we avoid reporting this metric when the page is not secure.

Here is a sample payload from documentFetchSpan for a non-secure(http) page
"events": [ { "attributes": [], "name": "fetchStart", "timeUnixNano": 1678483372712300000, "droppedAttributesCount": 0 }, { "attributes": [], "name": "domainLookupStart", "timeUnixNano": 1678483372712300000, "droppedAttributesCount": 0 }, { "attributes": [], "name": "domainLookupEnd", "timeUnixNano": 1678483372712300000, "droppedAttributesCount": 0 }, { "attributes": [], "name": "connectStart", "timeUnixNano": 1678483372712300000, "droppedAttributesCount": 0 }, { "attributes": [], "name": "secureConnectionStart", "timeUnixNano": 1678483372707100200, "droppedAttributesCount": 0 }, { "attributes": [], "name": "connectEnd", "timeUnixNano": 1678483372712300000, "droppedAttributesCount": 0 }, { "attributes": [], "name": "requestStart", "timeUnixNano": 1678483372716800300, "droppedAttributesCount": 0 }, { "attributes": [], "name": "responseStart", "timeUnixNano": 1678483372733600300, "droppedAttributesCount": 0 }, { "attributes": [], "name": "responseEnd", "timeUnixNano": 1678483372739200300, "droppedAttributesCount": 0 } ],
We can have sth like this in the instrumentation for the document fetch span to avoid adding this metric when page is not secure,
if (window.location.protocol === 'https') { addSpanNetworkEvent(span, PTN.SECURE_CONNECTION_START, resource); }
but this may not work for resources and xhr/fetch .

• This only affects the JavaScript OpenTelemetry library
• This may affect other libraries, but I would like to get opinions here first

[t2t2]

Same issue applies for cors: #3199 (and I know it is assigned to me but I just haven't had time to do it)

[t2t2]

Instead of window.location.protocol you could check resource.name (PerformanceEntry.name, provides absolute URL of the resource being loaded including protocol) to make an instrumentation agnostic solution (as this method is also used by other instrumentations)

[Abinet18]

@t2t2 , https://github.com/open-telemetry/opentelemetry-js/blob/main/packages/opentelemetry-sdk-trace-web/src/utils.ts#L82 , the resource here doesn't have the name property. It is a different type. We may have to pass the url to this function

[t2t2]

That just means otel has incomplete typings, because it definitely does exist in reality (sandbox)

And in typescript's standard dom definitions

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days.

[pichlermarc]

Fixed in #3879