PostHog can capture network requests that occur during the browser session, so you can see if your application is sending the expected requests and response, and check the effect of slow network requests or errors on the user experience.

You can enable network recording from your project settings:

Enable network recording in your PostHog

When enabled PostHog always captures:

the network request URL,
performance information about the request,

When request capture is enabled you can also enabled payload and body capture, this includes:

the request method
the response code
request & response headers (if enabled)
request & response body (if enabled)

Sensitive information

We automatically scrub some sensitive information from network headers and payloads, but if your request or response payloads could contain sensitive data, you should provide a function to mask the captured data when you initialize PostHog.

We have a deny-list of headers that we will never capture (even if you provide a masking function).

authorization
x-forwarded-for
authorization
cookie
set-cookie
x-api-key
x-real-ip
remote-addr
forwarded
proxy-authorization
x-csrf-token
x-csrftoken
x-xsrf-token

And we redact bodies if we believe they contain

credit card numbers
social security numbers
password
secret
passwd
api_key
apikey
auth
credentials
mysql_pwd
privatekey
private_key
token

Note: If you provide a masking function to alter redaction of payloads it entirely replaces PostHog's automatic payload redaction.

How to register a callback to inspect and redact each network request

Web

posthog.init('<ph_project_api_key>', {
    session_recording: {
        maskCapturedNetworkRequestFn: (request: CapturedNetworkRequest) => {
            // For example: ignoring a request entirely
            if (request.name.includes('example.com')) {
                return null
            }

            // ... or remove the query string from the URL
            request.name = request.name.split('?')[0]

            // ...redact the request or response body **however makes sense for your payloads**
            request.requestBody = request.requestBody?.replace(/"password":\s*"[^"]*"/g, '"password": "redacted-password"')
            request.responseBody = request.responseBody?.replace(/"password":\s*"[^"]*"/g, '"password": "redacted-password"')

            // ... or remove the request body
            request.requestBody = undefined

            // ... and more

            // finally return the request
            return request
        }
    }
})

Troubleshooting

Recording from localhost

Due the very high volume of network requests that some tools can make (for example when running hot-reload during development) PostHog does not capture network requests when running on localhost

Requests early in the page lifecycle don't capture all information

PostHog has to wrap fetch and xhr in order to capture network requests. If your application makes network requests before PostHog has had a chance to wrap them, then PostHog will not capture all information about the request.