PostHog
Canvas element is not shown in session recording
Bug description
In pages including components from echarts library (https://www.npmjs.com/package/echarts). The component is shown as blank area in the session recording.
Please describe.
In the gif we can see the original page with echarts component below.
The echart component is shown as blank area in the session recording.
Expected behavior
I expect see the content of the echarts component
How to reproduce
- Open recording session
- Watch the echarts component
Environment
self-managed posthog using docker images docker image with tag of release-1.18.0
Thank you for your bug report – we love squashing them!
@macobo What do you think about that? Can you add the label session recording?
Thanks for creating the issue!
We use rrweb under the hood here. rrweb indeed doesn't capture canvas (or webgl) content by default. They seem to have added functionality for canvas recently but the replayer flags are marked as unsafe and could cause issues.
Will need to think/see what we can do - want to avoid introducing a obvious security vulnerability during recording/playback. :thinking:
@macobo Thanks about your quick response. What do you think about adding an option for unsecured session recording for such cases?
Yep, but it requires a bit of planning and testing. The tricky part is not so much recording but playback as supporting canvas seems to require allowing javascript to run in the iframe created by rrweb which is both a security risk and might break replaying sessions in other ways.
The posthog team is about to go on a 2 week break - perhaps you're interested in testing things out and creating a PR for this? Happy to provide any assistance needed. :)
Is there any plan for this? I think this is super important since other session tracking tools in the market like FullStory, Logrocket can't track Canvas element.
@brainysteven We are mostly limited here by browser technology. It is technically doable and is supported by RRWeb (the library we use to do the recording) but playing it back requires enabling scripting in such a way that PostHog becomes vulnerable, hence why we haven't supported it so far.
