ref(integrations): route HTTP header filtering through data collection config by ericapisani · Pull Request #6788 · getsentry/sentry-python

ericapisani · 2026-07-08T19:38:54Z

_filter_headers follows the legacy send_default_pii/use_annotated_value behaviour when the data collection behaviour is not enabled in _experiments.

When data collection is enabled, it now delegates to _apply_key_value_collection_filtering from sentry_sdk.data_collection, so header scrubbing respects the new data_collection.http_headers.request allowlist/denylist/off configuration when data collection.

Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741.

Fixes PY-2584
Fixes #6744

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

linear-code · 2026-07-08T19:38:58Z

PY-2584

PY-2581

github-actions · 2026-07-08T19:48:47Z

Codecov Results 📊

✅ 92209 passed | ⏭️ 6302 skipped | Total: 98511 | Pass Rate: 93.6% | Execution Time: 316m 4s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +295
Passed Tests	📈 +295
Failed Tests	—
Skipped Tests	—

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2478 uncovered lines.
✅ Project coverage is 89.69%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
sentry_sdk/data_collection.py	100.00%	⚠️ 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    89.67%    89.69%    +0.02%
==========================================
  Files          193       193         —
  Lines        24004     24045       +41
  Branches      8340      8370       +30
==========================================
+ Hits         21526     21567       +41
- Misses        2478      2478         —
- Partials      1387      1387         —

Generated by Codecov Action

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

ericapisani · 2026-07-09T22:48:51Z

+        headers = _get_headers(asgi_scope)
+
+        request_data["headers"] = _filter_headers(
+            headers,
+            use_annotated_value=False,


This change was done because when if the headers are filtered with "allowlist" and no terms are provided, and the "host" header is present, then the constructed URL in _get_url below would contain [Filtered] within the URL.

Doing this ensures that it gets filtered from the headers to respect data collection, but still correctly appears in the url

As long as this doesn't affect current behavior should be ok 👍🏻

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

sentrivana

Lgtm! Left some suggestions.

sentrivana · 2026-07-21T09:36:54Z

+        for key in filtered:
+            if isinstance(key, str) and key.lower() in ("cookie", "set-cookie"):
+                filtered[key] = SENSITIVE_DATA_SUBSTITUTE


Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741.

This means this cookies logic will be updated later right?

Correct, it's part of #6797 😄

sentrivana · 2026-07-21T10:43:50Z

+        _experiments={
+            "trace_lifecycle": "stream",
+            "data_collection": options["data_collection"],
+        },


Suggested change

_experiments={

"trace_lifecycle": "stream",

"data_collection": options["data_collection"],

},

trace_lifecycle="stream",

_experiments={

"data_collection": options["data_collection"],

},

sentrivana · 2026-07-21T10:45:38Z

+
+    (server_span,) = [item.payload for item in items]
+
+    if request.node.callspec.id.endswith("data_collection_off_does_not_add_headers"):


Can we, instead of matching on the id here, just match on expected is None?

Suggested change

if request.node.callspec.id.endswith("data_collection_off_does_not_add_headers"):

if expected is None:

Yeah, that works here 👍🏻

sentrivana · 2026-07-21T10:46:37Z

+    # client.address and user.ip_address is captured under send_default_pii=True.
+    # TODO: This block will eventually need to be removed from this test into a separate
+    # test once data collection gating is introduced on these values
+    if options["send_default_pii"]:
+        assert server_span["attributes"]["client.address"] == "127.0.0.1"
+        assert server_span["attributes"]["user.ip_address"] == "127.0.0.1"
+    else:
+        assert "user.ip_address" not in server_span["attributes"]
+        assert "client.address" not in server_span["attributes"]


Why have this here in the first place? It doesn't look related to sensitive header behavior

It isn't related to sensitive header behaviour, but I had decided to add this in to make it clear that it isn't expected that user data would be present when data collection is enabled just yet.

Since assertions on these values appear in other tests within the file, I thought that not having assertions like these in a data collection-specific context would raise flags.

sentrivana · 2026-07-21T10:50:35Z

    }


+def test_get_request_data_url_with_filtered_host(sentry_init):


Could we change these new test cases to set up a proper ASGI app, like the tests below? Just to make them a little less unit-testy.

I missed this earlier on, but I addressed this in https://github.com/getsentry/sentry-python/pull/6841/changes#diff-a4ca49dac9c5fcce27a4fb5fb53e5f8e764b807773ba7c5476d70d74a9789353 as

I can look into pulling that change into this branch, but if we wanted to merge this stack 1 big feature branch, it won't make a difference as it'll eventually be applied.

sentrivana · 2026-07-21T10:52:45Z

+    assert len(spans) == 1
+
+    segment = spans[0]
+    if request.node.callspec.id == "data_collection_off_does_not_add_headers":


Same suggestion as above, to make this a bit more future-proof if someone decides to change the ID.

Suggested change

if request.node.callspec.id == "data_collection_off_does_not_add_headers":

if expected is None:

ericapisani added 2 commits July 9, 2026 09:47

Merge branch 'master' into py-2584-update-wsgi-filter-headers

5e9f610

Make changes to adjust to the data collection option being within the…

a590c8e

… _experiments property in the client

sentry-warden Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread sentry_sdk/data_collection.py

fix test

16ed0c8

sentry-warden Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread sentry_sdk/integrations/_wsgi_common.py

ericapisani added 5 commits July 9, 2026 14:41

make sure host header is not filtered when being added to the url

486f0bc

add test coverage for edge case around host header being dropped but …

7d14a81

…still being needed for the url attribute

add aws lambda test coverage

bb98334

add test coverage within the wsgi test file

951c408

ericapisani commented Jul 9, 2026

View reviewed changes

ericapisani marked this pull request as ready for review July 9, 2026 22:48

ericapisani requested a review from a team as a code owner July 9, 2026 22:48

ericapisani added 8 commits July 14, 2026 13:43

Make changes to adjust to the data collection option being within the…

d0bae90

… _experiments property in the client

fix test

a6c4688

make sure host header is not filtered when being added to the url

d7b378b

add test coverage for edge case around host header being dropped but …

52c2da1

…still being needed for the url attribute

add aws lambda test coverage

aa645d7

add test coverage within the wsgi test file

d717172

ericapisani force-pushed the py-2584-update-wsgi-filter-headers branch from 951c408 to d717172 Compare July 14, 2026 17:43

Merge branch 'py-2584-update-wsgi-filter-headers' of github.com:getse…

c7f590f

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

sentry Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread sentry_sdk/data_collection.py

Merge branch 'master' into py-2584-update-wsgi-filter-headers

e9f0e20

ericapisani marked this pull request as draft July 15, 2026 19:23

test(aiohttp): Expect single span in streaming passthrough test

3d7bddb

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

ericapisani marked this pull request as ready for review July 15, 2026 19:47

sentry Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread sentry_sdk/data_collection.py

Merge branch 'master' into py-2584-update-wsgi-filter-headers

ec90ac6

sentry Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread sentry_sdk/integrations/_wsgi_common.py

Merge branch 'master' into py-2584-update-wsgi-filter-headers

5773973

sentrivana approved these changes Jul 21, 2026

View reviewed changes


		(server_span,) = [item.payload for item in items]

		if request.node.callspec.id.endswith("data_collection_off_does_not_add_headers"):

	if request.node.callspec.id.endswith("data_collection_off_does_not_add_headers"):
	if expected is None:

		}


		def test_get_request_data_url_with_filtered_host(sentry_init):

	if request.node.callspec.id == "data_collection_off_does_not_add_headers":
	if expected is None:

Uh oh!

Conversation

ericapisani commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear-code Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Results 📊

📊 Comparison with Base Branch

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sentrivana left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ericapisani commented Jul 8, 2026 •

edited

Loading

github-actions Bot commented Jul 8, 2026 •

edited

Loading