Platforms
New Relic Browser
New Relic's browser monitoring is recognisable from its agent script host, the `NREUM` configuration object and its `nr-data.net` beacon hosts. The key in that configuration is a browser key: New Relic's documentation separates browser keys, used to report browser monitoring data, from license keys, used for almost everything else. Seeing the browser agent tells you visitor experience is measured; it says nothing about backend APM, which is not observable from outside.
How the engine recognises it
The `js-agent.newrelic.com` script host.
The `NREUM` global that holds the agent's configuration.
`bam.nr-data.net` or `bam-cell.nr-data.net` beacon hosts, where the agent reports.
Any one match reports the browser agent; APM instrumentation is never inferred from it.
Browser key and license key
New Relic's key documentation describes license keys as used to report almost all data, except browser and mobile data, which use their own keys.
It describes browser keys as used to report browser monitoring data, each tied to a specific account.
The key in a page's agent configuration is therefore a browser key, designed to be delivered to browsers.
The documentation recommends a rotation strategy for license and browser keys — creating new keys and deleting old ones on a schedule — which is the remedy if a browser key is abused.
The same page lists the browser key as a key used for data ingest, tied to one account, with as many as needed allowed — which is what makes per-site keys and clean rotation possible.
What browser monitoring implies
New Relic describes browser monitoring as a real-user monitoring solution measuring speed and performance as visitors use the site, including JavaScript errors and AJAX requests.
That is visitor data sent to a third party, and it belongs in the site's privacy notice.
Features such as session replay are configured in the account and are not visible from the page.
New Relic's installation guide says to paste the copy/paste snippet as close to the top of the `<head>` as possible, so the agent's code is part of every page it instruments.
New Relic's introduction says browser monitoring goes beyond the initial page load to measure full page life cycle data.
What an external audit can and cannot tell
It can tell that the browser agent loads on the pages crawled.
It cannot tell which features are enabled, what is sampled, or how data is retained.
It cannot see server-side APM, infrastructure agents or logs.
It never sends data to the beacon.
Which checks apply
`monitoring.new_relic` reports the browser agent when detected, and not verifiable otherwise.
`monitoring.summary` places it among the other public monitoring signals.
`exposure.secrets.private` reports private credentials in served code, which a browser key is not.
`performance.third_party_resources` and `performance.page_weight` measure what the agent adds.
Ways the agent gets into a page
New Relic's installation guide describes three methods: copying a snippet into the page, installing with npm, and injection by an APM agent.
With an APM agent, the guide says browser monitoring is deployed without manually adding the snippet, and the agent uses the latest browser agent version when restarted.
The browser agent's support policy states that versions not listed in its table are no longer supported, and asks users to update to the latest release.
A copy/paste snippet is frozen at the version it was copied at, which is how old agents linger on pages nobody revisits.
The audit reports the agent's presence; which method put it there is not always visible.
Frequently asked questions
- Is the New Relic key in my page a license key?
- It should be a browser key, which is designed for browsers. License keys report almost everything else and should never appear in front-end code.
- Does the browser agent mean my servers use New Relic APM?
- No. Browser monitoring is a separate product. APM instrumentation is not observable from outside.
- How do I limit the impact of a leaked browser key?
- Follow New Relic's rotation advice: create a new key, update the agent configuration, and delete the old key.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website