AudienceNetwork (S2S): add missing ext.security_app_id in OpenRTB requests to fix production auth failures#4196
AudienceNetwork (S2S): add missing ext.security_app_id in OpenRTB requests to fix production auth failures#4196PeakLee wants to merge 5 commits intoprebid:masterfrom
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a production authentication failure in the Meta Audience Network S2S bidding integration by adding the missing ext.security_app_id field to OpenRTB requests. The issue was causing 400 errors with "Error validating authentication token" in production mode (test=0) while test mode (test=1) continued to work.
- Added
securityAppIdfield toAudienceNetworkExtclass with proper JSON serialization - Updated
AudienceNetworkBidderto pass the platform ID as the security app ID in OpenRTB requests
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| AudienceNetworkExt.java | Added securityAppId field with JsonProperty annotation for OpenRTB serialization |
| AudienceNetworkBidder.java | Modified request building to include platformId as the securityAppId parameter |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| .app(makeApp(bidRequest.getApp(), publisherId)) | ||
| .ext(mapper.fillExtension( | ||
| ExtRequest.empty(), AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId())))) | ||
| ExtRequest.empty(), AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()), platformId))) |
There was a problem hiding this comment.
The platformId parameter is passed twice - once for the platformid field and again for the securityAppId field. Consider extracting this to a variable or adding a comment explaining why the same value is used for both fields to improve code clarity.
|
@SerhiiNahornyi help to check it |
|
@PeakLee pls fix checkstyle |
…roperty annotation
@osulzhenko please check it again, just fixed the checkstyle issue and import missed "JsonProperty" annotation |
|
@PeakLee it still has invalid code in tests. Please take a look when you have time |
…in expected output
|
really sorry, forget the testcase updated, but i hava just fixed the issue, please check it again @osulzhenko , really appreciated !
|
|
@AntoxaAntoxic please help to check this merge request, thanks a lot |
AntoxaAntoxic
left a comment
AntoxaAntoxic
left a comment
There was a problem hiding this comment.
Here is a few comments.
And also a question: Is there the same PR for PBS Go? If yes, please link it here.
Thank you!
| @JsonProperty("authentication_id") | ||
| String authenticationId; | ||
|
|
||
| @JsonProperty("security_app_id") |
There was a problem hiding this comment.
@JsonPropertys are redundant here, please remove
| .ext(mapper.fillExtension(ExtRequest.empty(), | ||
| AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()), | ||
| platformId))) |
There was a problem hiding this comment.
please fix formatting
.ext(mapper.fillExtension(
ExtRequest.empty(),
AudienceNetworkExt.of(platformId, makeAuthId(bidRequest.getId()), platformId)))| "authentication_id": "48b7d18b921be9887a5351f31cc85f1326e3da1d8c402dec2bd338cf10bd6b43", | ||
| "platformid": "101" | ||
| "platformid": "101", | ||
| "security_app_id": "101" |
There was a problem hiding this comment.
May I ask you to change values of the properties to something more readable like
"authentication_id": "authentication_id",
"platformid": "platformid",
"security_app_id": "platformid"It'll be much more readable
P.S. I'd nice if you do the same in the AudienceNetworkBidderTest
|
@PeakLee any updates on this one? |
3 participants
In short:
AudienceNetwork (S2S): include ext.security_app_id in OpenRTB requests.
Fixes a production-only 400 ("Error validating authentication token") when test=0,
while test=1 works. Adds field wiring in AudienceNetworkExt and passes it through
AudienceNetworkBidder. Verified end-to-end with Meta Audience Network engineers.
Summary
This PR fixes a production-only failure in the Meta Audience Network (AN) S2S bidding integration within Prebid Server Java.
In production (test=0), AN requires ext.security_app_id alongside ext.authentication_id for request authentication. The field was not present in outgoing requests, leading to 400 responses (x-fb-an-errors: Error validating authentication token).
Adding ext.security_app_id resolves the issue. Test mode (test=1) remained unaffected, which masked the missing field during integration testing.
Problem Statement
# Observed:
• test=1 requests succeed end-to-end.
• test=0 requests fail with HTTP 400, headers include x-fb-an-errors=Error validating authentication token, often with empty body and standard Meta edge headers.
# Impact: Audience Network bidding seat is effectively disabled in production traffic, reducing competition and potential yield.