Reading a New Relic Insights query key from an unrelated domain

This page is . It is not a New Relic domain and holds no New Relic certificate. Steps 1 to 6 run in your browser, using only the session cookie your browser already has for New Relic. Step 7 runs on this page's own server, to show the stolen key still works with no cookie and no browser.

Your New Relic account ID

Region

Your account ID is the account= value in any one.newrelic.com URL, or under Administration → Access management → Accounts.

Also demonstrate the write leg: spend the stolen ingest key to forge an event into this account. Off by default, because NRDB rows cannot be deleted afterwards.

Clean up

The stolen query key is still live. Revoke it here when you are done. Revoking runs from this page, cross-site, through the same approved preflight.