{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "slug": "dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup", "url": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/" }, "title": "Make React Native device-ID promises settle before trusting telemetry startup", "summary": "Can a custom device-information provider delay Application Insights event processing?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:54+00:00", "modified_at": "2026-09-10T02:11:19+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 237, "potentially_affected": "Application Insights React Native plug-in integrations supplying a custom asynchronous getUniqueId implementation.", "dse_recommendation": "Define explicit success and failure completion for the custom device-ID lookup and test both paths during application startup.", "primary_source": { "name": "Enable a framework extension for Application Insights JavaScript SDK - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/javascript-framework-extensions", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The React Native plug-in’s device-information interface permits getUniqueId to return a string or a promise. For a promise, event processing waits until it resolves or rejects. Microsoft documents a default five-second uniqueIdPromiseTimeout that unblocks processing using a previously configured value, and setDeviceId can also release the waiting state. The source warns against an implementation whose promise never settles. Microsoft Learn.

\n

Applicability

\n

Investigate this startup dependency when the application supplies its own device-information module. Keep the identity lookup’s completion and the later delivery of telemetry as separate observations; neither an initialized SDK nor an eventual event proves the custom lookup behaved correctly.

\n

DSE recommendation

\n

Define explicit success and failure completion for the custom device-ID lookup and test both paths during application startup. Ask the developer to document the intended fallback rather than relying on an accidental timeout. Avoid changing the identity scheme merely to conceal a blocked startup dependency, and keep any chosen identifier consistent with the application’s approved data-handling design.

\n

Verification

\n

In a test build, exercise immediate success, deliberate rejection and a lookup delayed beyond the configured timeout. Record when the lookup settles, when event processing resumes and which expected identifier is attached. Confirm that the fallback behavior is intentional and does not misattribute events. Keep a never-settling implementation as a defect even if the documented timeout eventually allows telemetry to continue.

\n

Official references

\n

Microsoft Learn: JavaScript framework extensions and device information. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe React Native plug-in’s device-information interface permits getUniqueId to return a string or a promise. For a promise, event processing waits until it resolves or rejects. Microsoft documents a default five-second uniqueIdPromiseTimeout that unblocks processing using a previously configured value, and setDeviceId can also release the waiting state. The source warns against an implementation whose promise never settles. Microsoft Learn.\nApplicability\nInvestigate this startup dependency when the application supplies its own device-information module. Keep the identity lookup’s completion and the later delivery of telemetry as separate observations; neither an initialized SDK nor an eventual event proves the custom lookup behaved correctly.\nDSE recommendation\nDefine explicit success and failure completion for the custom device-ID lookup and test both paths during application startup. Ask the developer to document the intended fallback rather than relying on an accidental timeout. Avoid changing the identity scheme merely to conceal a blocked startup dependency, and keep any chosen identifier consistent with the application’s approved data-handling design.\nVerification\nIn a test build, exercise immediate success, deliberate rejection and a lookup delayed beyond the configured timeout. Record when the lookup settles, when event processing resumes and which expected identifier is attached. Confirm that the fallback behavior is intentional and does not misattribute events. Keep a never-settling implementation as a defect even if the documented timeout eventually allows telemetry to continue.\nOfficial references\nMicrosoft Learn: JavaScript framework extensions and device information. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe React Native plug-in’s device-information interface permits getUniqueId to return a string or a promise. For a promise, event processing waits until it resolves or rejects. Microsoft documents a default five-second uniqueIdPromiseTimeout that unblocks processing using a previously configured value, and setDeviceId can also release the waiting state. The source warns against an implementation whose promise never settles. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/javascript-framework-extensions).\n\n## Applicability\n\nInvestigate this startup dependency when the application supplies its own device-information module. Keep the identity lookup’s completion and the later delivery of telemetry as separate observations; neither an initialized SDK nor an eventual event proves the custom lookup behaved correctly.\n\n## DSE recommendation\n\nDefine explicit success and failure completion for the custom device-ID lookup and test both paths during application startup. Ask the developer to document the intended fallback rather than relying on an accidental timeout. Avoid changing the identity scheme merely to conceal a blocked startup dependency, and keep any chosen identifier consistent with the application’s approved data-handling design.\n\n## Verification\n\nIn a test build, exercise immediate success, deliberate rejection and a lookup delayed beyond the configured timeout. Record when the lookup settles, when event processing resumes and which expected identifier is attached. Confirm that the fallback behavior is intentional and does not misattribute events. Keep a never-settling implementation as a defect even if the documented timeout eventually allows telemetry to continue.\n\n## Official references\n\n[Microsoft Learn: JavaScript framework extensions and device information](https://learn.microsoft.com/en-us/azure/azure-monitor/app/javascript-framework-extensions). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Make React Native device-ID promises settle before trusting telemetry startup", "item": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/", "headline": "Make React Native device-ID promises settle before trusting telemetry startup", "description": "Can a custom device-information provider delay Application Insights event processing?", "abstract": "Can a custom device-information provider delay Application Insights event processing?", "articleBody": "Source facts\nThe React Native plug-in’s device-information interface permits getUniqueId to return a string or a promise. For a promise, event processing waits until it resolves or rejects. Microsoft documents a default five-second uniqueIdPromiseTimeout that unblocks processing using a previously configured value, and setDeviceId can also release the waiting state. The source warns against an implementation whose promise never settles. Microsoft Learn.\nApplicability\nInvestigate this startup dependency when the application supplies its own device-information module. Keep the identity lookup’s completion and the later delivery of telemetry as separate observations; neither an initialized SDK nor an eventual event proves the custom lookup behaved correctly.\nDSE recommendation\nDefine explicit success and failure completion for the custom device-ID lookup and test both paths during application startup. Ask the developer to document the intended fallback rather than relying on an accidental timeout. Avoid changing the identity scheme merely to conceal a blocked startup dependency, and keep any chosen identifier consistent with the application’s approved data-handling design.\nVerification\nIn a test build, exercise immediate success, deliberate rejection and a lookup delayed beyond the configured timeout. Record when the lookup settles, when event processing resumes and which expected identifier is attached. Confirm that the fallback behavior is intentional and does not misattribute events. Keep a never-settling implementation as a defect even if the documented timeout eventually allows telemetry to continue.\nOfficial references\nMicrosoft Learn: JavaScript framework extensions and device information. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:22:54+00:00", "dateModified": "2026-09-10T02:11:19+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-542-make-react-native-device-id-promises-settle-before-trusting-telemetry-startup/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Make React Native device-ID promises settle before trusting telemetry startup" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Enable a framework extension for Application Insights JavaScript SDK - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/javascript-framework-extensions" } } ] } }