[http-plugin] Include trace ID in response headers for incoming requests

[OlivierAlbertini]

Is your feature request related to a problem? Please describe.

• Having trace id in headers can help to debug slow requests we see in
  the browser by looking up the trace ID found in response headers.
• It can help the propagation

Describe the solution you'd like
Inject trace id in the response header and only for incoming requests.

Should we make this behaviour optional and disabled by default ?

[danielkhan]

I think this would be something that needs to be discussed on the specification level.

Reasons

• The browser can serve any backend which may be Java, Python, Go, so a Node.js only solution is not viable.
• There are plans to establish a standard on w3c Trace Context that will cover response headers.
• There are some security considerations around it because it means that the trace id might unintentionally cross trust boundaries.
• There may be privacy considerations because it makes a user and all its subsequent requests identifiable. Think about an initial web request and subsequent ajax requests that then contain this trace id.

I'm not saying that I think that it does not make sense but this may be bigger than this SIG.

[OlivierAlbertini]

@danielkhan Thanks for your response. Should we move this issue to another repo ?

[vmarchaud]

https://github.com/open-telemetry/opentelemetry-specification would be the correct place

[OlivierAlbertini]

Thanks @vmarchaud

I close this issue and we could reopen a new one after resolving this one open-telemetry/opentelemetry-specification#206

[draffensperger]

Something to note as well is that the browser can currently only read the Server-Timing response header in JS code, and that only in modern browsers.

What we did in OpenCensus Web to pass the trace ID back to the browser client was to have the server set a window.traceparent variable in the rendered template.

I would love to have optional trace response headers in the spec and have a proposal on the table for a JS API to read that header!! That plus a CORS exclusion for the trace-context header would help make tracing more easily usable in the browser.