fix: extract http.referer from resolved ALB headers

Reuse resolve_alb_request_headers for referer tagging so multiValueHeaders
events and lowercase referer keys are handled consistently with other ALB
HTTP facet tags.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: chemystery09

datadog_lambda/trigger.py

@@ -316,6 +316,16 @@ def resolve_alb_request_headers(event):
     return resolved
 
 
+def _get_header_case_insensitive(headers, name):
+    if not isinstance(headers, dict):
+        return None
+    name_lower = name.lower()
+    for key, value in headers.items():
+        if isinstance(key, str) and key.lower() == name_lower and value:
+            return value
+    return None
+
+
 def extract_http_tags(event):
     """
     Extracts HTTP facet tags from the triggering event
@@ -329,6 +339,7 @@ def extract_http_tags(event):
 
     path = event.get("path")
     method = event.get("httpMethod")
+    request_headers = None
 
     if request_context and request_context.get("stage"):
         domain_name = request_context.get("domainName")
@@ -350,13 +361,13 @@ def extract_http_tags(event):
     elif request_context and request_context.get("elb"):
         # ALB events have no requestContext.stage; derive the URL from the
         # forwarded host/proto headers and the top-level path.
-        alb_headers = resolve_alb_request_headers(event)
-        host = alb_headers.get("host")
+        request_headers = resolve_alb_request_headers(event)
+        host = request_headers.get("host")
         if host:
-            proto = alb_headers.get("x-forwarded-proto", "http")
+            proto = request_headers.get("x-forwarded-proto", "http")
             http_tags["http.url"] = proto + "://" + host
 
-        user_agent = alb_headers.get("user-agent")
+        user_agent = request_headers.get("user-agent")
         if user_agent:
             http_tags["http.useragent"] = user_agent
 
@@ -370,13 +381,14 @@ def extract_http_tags(event):
     if method:
         http_tags["http.method"] = method
 
-    # Safely get headers
-    headers = event.get("headers", {})
-    if not isinstance(headers, dict):
-        headers = {}
+    if request_headers is None:
+        request_headers = event.get("headers")
+        if not isinstance(request_headers, dict):
+            request_headers = {}
 
-    if headers and headers.get("Referer"):
-        http_tags["http.referer"] = headers.get("Referer")
+    referer = _get_header_case_insensitive(request_headers, "referer")
+    if referer:
+        http_tags["http.referer"] = referer
 
     # Try to get `routeKey` from API GW v2; otherwise try to get `resource` from API GW v1
     route = event.get("routeKey") or event.get("resource")

tests/test_trigger.py

@@ -450,6 +450,26 @@ def test_extract_trigger_tags_application_load_balancer_multivalue_headers(self)
         )
         assert tags.get("http.useragent").startswith("Mozilla/5.0")
 
+    def test_extract_trigger_tags_alb_referer_from_lowercase_headers(self):
+        event_sample_source = "application-load-balancer"
+        with open(event_samples + event_sample_source + ".json") as event_file:
+            event = json.load(event_file)
+        event["headers"]["referer"] = "https://example.com/page"
+
+        tags = extract_trigger_tags(event, get_mock_context())
+
+        self.assertEqual(tags.get("http.referer"), "https://example.com/page")
+
+    def test_extract_trigger_tags_alb_referer_from_multivalue_headers(self):
+        event_sample_source = "application-load-balancer-multivalue-headers"
+        with open(event_samples + event_sample_source + ".json") as event_file:
+            event = json.load(event_file)
+        event["multiValueHeaders"]["referer"] = ["https://example.com/page"]
+
+        tags = extract_trigger_tags(event, get_mock_context())
+
+        self.assertEqual(tags.get("http.referer"), "https://example.com/page")
+
     def test_extract_trigger_tags_cloudfront(self):
         event_sample_source = "cloudfront"
         test_file = event_samples + event_sample_source + ".json"
@@ -636,6 +656,17 @@ def test_extract_http_tags_with_invalid_headers(self):
         # Should not raise an exception
         self.assertEqual(http_tags, {"span.kind": "server"})
 
+    def test_extract_http_tags_referer_case_insensitive(self):
+        from datadog_lambda.trigger import extract_http_tags
+
+        event = {"headers": {"Referer": "https://example.com/capitalized"}}
+        http_tags = extract_http_tags(event)
+        self.assertEqual(http_tags.get("http.referer"), "https://example.com/capitalized")
+
+        event = {"headers": {"referer": "https://example.com/lowercase"}}
+        http_tags = extract_http_tags(event)
+        self.assertEqual(http_tags.get("http.referer"), "https://example.com/lowercase")
+
     def test_extract_http_tags_with_invalid_route(self):
         from datadog_lambda.trigger import extract_http_tags