Test trace propagation from an ASP.NET Core endpoint to a fake downstream HTTP service.

Configure an in-memory OpenTelemetry exporter in the test host. Call an endpoint that uses HttpClient against a stub server. Assert the server span and dependency span share a trace id and the dependency is a child. Do not assert generated span ids.

A slow dependency span can be found underneath the exact API request, carrying stable route and service attributes without user payloads.

• Use a test exporter and fake downstream service.
• Assert relationships, not random identifiers.
• Keep attribute values low-cardinality and non-sensitive.
• Avoid sending telemetry to a real backend.

I collect completed activities in memory and find spans by stable operation names and kinds. Trace-id equality plus parent-span equality proves propagation more directly than checking that two spans merely exist.

[Fact]
public async Task Pricing_dependency_is_child_of_api_request_span()
{
    var exported = new InMemoryActivityExporter();
    await using var factory = new ApiTestFactory(services =>
        services.AddOpenTelemetry()
            .WithTracing(builder => builder
                .AddAspNetCoreInstrumentation()
                .AddHttpClientInstrumentation()
                .AddProcessor(new SimpleActivityExportProcessor(exported))));

    var client = factory.CreateAuthenticatedClient("user-1", "quotes.read");
    var response = await client.GetAsync("/api/quotes/p-1");
    response.EnsureSuccessStatusCode();
    await exported.WaitForExportsAsync(expectedMinimum: 2);

    var server = exported.Single(activity => activity.Kind == ActivityKind.Server);
    var dependency = exported.Single(activity =>
        activity.Kind == ActivityKind.Client && activity.DisplayName.Contains("pricing"));

    Assert.Equal(server.TraceId, dependency.TraceId);
    Assert.Equal(server.SpanId, dependency.ParentSpanId);
}

This validates instrumentation wiring without a real telemetry service. Exact span names vary by instrumentation version, so the production implementation should define stable custom operation attributes where ownership requires them.

• The downstream service returns an error.
• The request is sampled out under production policy.
• Messaging introduces a process boundary.
• Sensitive query strings appear as attributes.

• Test successful and failed dependency spans.
• Assert no exporter network calls occur.
• Check stable route attributes without exact random ids.

• Comparing random trace ids to hard-coded values.
• Sending test telemetry to production.
• Adding user ids or payloads as high-cardinality attributes.
• Checking logs only and assuming trace parentage.