Added easy to interpret metrics for observability and related tests via Prometheus - #1034
Added easy to interpret metrics for observability and related tests via Prometheus#1034shantanushok wants to merge 9 commits into
Conversation
|
@shantanushok is attempting to deploy a commit to the Darshan's projects Team on Vercel. A member of the Team first needs to authorize it. |
There was a problem hiding this comment.
Pull request overview
This PR adds Prometheus counters to the CSRF OriginValidationMiddleware so CSRF decision outcomes (safe-method skip, allowed, rejected) and rejection reasons can be tracked for observability, and it extends the CSRF test suite with a regression test that asserts these metrics increase as expected.
Changes:
- Added Prometheus
Countermetrics inbackend/middleware/csrf.pyand incremented them on safe-method skips, allows, and rejects (including method + reason for rejects). - Added a CSRF Prometheus metrics regression test in
backend/tests/test_csrf.pyto validate counter increments via real requests through the middleware.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| backend/middleware/csrf.py | Introduces csrf_requests_total and csrf_rejections_total counters and increments them on CSRF decision paths. |
| backend/tests/test_csrf.py | Adds a metrics-focused regression test that checks Prometheus counters increase after representative requests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| from prometheus_client import Counter | ||
|
|
||
| logger = logging.getLogger(__name__) | ||
|
|
||
| # Prometheus Metrics |
| assert after_skipped > before_skipped | ||
|
|
||
| # 2. Trigger an allowed method | ||
| client.post("/api/sessions/", json={"title": "Metric allowed"}) |
imDarshanGK
added
SSoC26
|
Hey @imDarshanGK please review the PR and hopefully merge it :/ |
imDarshanGK
left a comment
imDarshanGK
left a comment
There was a problem hiding this comment.
@shantanushok backend/requirements_fixed.txt this is duplicate
remove this
|
@imDarshanGK should I remove this file from the other PR too ? |
|
Hey @imDarshanGK |
|
@imDarshanGK i have made the changes you had requested please re approve the workflows . |
Description
Resolves #919
Added easy to interpret metrics for observability and related tests via Prometheus. This ensures that CSRF evaluations (allowances, rejections, and safe method skips) are correctly tracked and monitored.
Summary of Changes
backend/middleware/csrf.py:Counterfromprometheus_clientand definedCSRF_REQUESTSandCSRF_REJECTIONSmetrics.OriginValidationMiddlewareto incrementcsrf_requests_totalfor safe methods (skipped_safe_method), authorized origins (allowed), and unauthorized cross-origin requests (rejected).csrf_rejections_totalto specify the HTTP method andinvalid_originreason when a request is blocked.backend/tests/test_csrf.py:test_prometheus_metricsregression test, which was previously failing due toAssertionError: assert 0.0 > 0.0caused by the missing middleware implementation.Verification
Ran backend CSRF validation and metrics regression tests: