ref(integrations): route HTTP header filtering through data collection config by ericapisani · Pull Request #6788 · getsentry/sentry-python

ericapisani · 2026-07-08T19:38:54Z

_filter_headers follows the legacy send_default_pii/use_annotated_value behaviour when the data collection behaviour is not enabled in _experiments.

When data collection is enabled, it now delegates to _apply_key_value_collection_filtering from sentry_sdk.data_collection, so header scrubbing respects the new data_collection.http_headers.request allowlist/denylist/off configuration when data collection.

Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741.

Fixes PY-2584
Fixes #6744

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

linear-code · 2026-07-08T19:38:58Z

PY-2584

PY-2581

github-actions · 2026-07-08T19:48:47Z

Codecov Results 📊

✅ 92149 passed | ⏭️ 6302 skipped | Total: 98451 | Pass Rate: 93.6% | Execution Time: 314m 21s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +295
Passed Tests	📈 +296
Failed Tests	📉 -1
Skipped Tests	—

➖ Removed Tests (1)

View removed tests

test_trace_decorator_async_no_trx
- File: tests.tracing.test_decorator

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2478 uncovered lines.
✅ Project coverage is 89.69%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
sentry_sdk/data_collection.py	100.00%	⚠️ 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    89.68%    89.69%    +0.01%
==========================================
  Files          193       193         —
  Lines        24004     24045       +41
  Branches      8340      8370       +30
==========================================
+ Hits         21527     21567       +40
- Misses        2477      2478        +1
- Partials      1386      1389        +3

Generated by Codecov Action

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

ericapisani · 2026-07-09T22:48:51Z

+        headers = _get_headers(asgi_scope)
+
+        request_data["headers"] = _filter_headers(
+            headers,
+            use_annotated_value=False,


This change was done because when if the headers are filtered with "allowlist" and no terms are provided, and the "host" header is present, then the constructed URL in _get_url below would contain [Filtered] within the URL.

Doing this ensures that it gets filtered from the headers to respect data collection, but still correctly appears in the url

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

sentry · 2026-07-16T11:52:25Z

+
+
 def _map_from_send_default_pii(


Bug: The _filter_headers function unconditionally redacts Cookie and Set-Cookie headers, ignoring the user's data_collection allowlist configuration and preventing cookie capture.
_{Severity: MEDIUM}

Suggested Fix

Remove the hardcoded redaction loop for Cookie and Set-Cookie headers from the _filter_headers function. The _apply_key_value_collection_filtering function should be the sole authority for filtering based on the user's configuration. If cookies need special default handling, they should be added to the _SENSITIVE_DENYLIST so users can override the behavior via the allowlist.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: sentry_sdk/data_collection.py#L136-L138 Potential issue: The `_filter_headers` function unconditionally redacts `Cookie` and `Set-Cookie` headers, even when a user explicitly includes them in the `data_collection.http_headers.request` allowlist. While the initial filtering step correctly respects the allowlist, a subsequent hardcoded loop overwrites the cookie values with `SENSITIVE_DATA_SUBSTITUTE`. This behavior is confirmed by a test case which states that cookies are "always redacted...even when explicitly allowlisted". This prevents users from capturing cookie values via the data collection API, silently ignoring their explicit configuration and creating inconsistent behavior compared to other allowlisted headers.

Also affects:

sentry_sdk/integrations/_wsgi_common.py

tests/integrations/wsgi/test_wsgi.py

sentry · 2026-07-16T17:56:15Z

+
+        filtered = _apply_key_value_collection_filtering(
+            items=headers,
+            behaviour=data_collection_configuration["http_headers"]["request"],
+        )
+
+        for key in filtered:
+            if isinstance(key, str) and key.lower() in ("cookie", "set-cookie"):
+                filtered[key] = SENSITIVE_DATA_SUBSTITUTE

-    return {
-        k: (v if k.upper().replace("-", "_") not in SENSITIVE_HEADERS else substitute)
-        for k, v in headers.items()
-    }
+        return filtered


Bug: The _filter_headers function ignores the use_annotated_value parameter in its data collection path, leading to inconsistent redaction of sensitive headers compared to the legacy path.
_{Severity: MEDIUM}

Suggested Fix

Modify the data collection path within _filter_headers to respect the use_annotated_value parameter. When use_annotated_value is True, use AnnotatedValue.removed_because_over_size_limit() as the substitute for filtered values instead of the hardcoded SENSITIVE_DATA_SUBSTITUTE. This will align the behavior of the data collection path with the legacy path.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: sentry_sdk/integrations/_wsgi_common.py#L212-L224 Potential issue: The `_filter_headers` function in `_wsgi_common.py` accepts a `use_annotated_value` parameter which defaults to `True`. However, in the new code path for data collection (lines 212-224), this parameter is ignored. When data collection is enabled, sensitive headers are always replaced with the literal string `"[Filtered]"`. This contrasts with the legacy path, where `use_annotated_value=True` causes sensitive headers to be replaced with an `AnnotatedValue` object that includes metadata. This inconsistency in the event payload structure can break downstream consumers that expect the metadata from `AnnotatedValue` and affects multiple integrations (WSGI, Tornado, Sanic, Quart, aiohttp) that rely on the default behavior.

Also affects:

sentry_sdk/integrations/wsgi.py:357

sentry_sdk/integrations/tornado.py:279

sentry_sdk/integrations/sanic.py:427

sentry_sdk/integrations/quart.py:250

sentry_sdk/integrations/aiohttp.py:470

ericapisani added 2 commits July 9, 2026 09:47

Merge branch 'master' into py-2584-update-wsgi-filter-headers

5e9f610

Make changes to adjust to the data collection option being within the…

a590c8e

… _experiments property in the client

sentry-warden Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread sentry_sdk/data_collection.py

fix test

16ed0c8

sentry-warden Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread sentry_sdk/integrations/_wsgi_common.py

ericapisani added 5 commits July 9, 2026 14:41

make sure host header is not filtered when being added to the url

486f0bc

add test coverage for edge case around host header being dropped but …

7d14a81

…still being needed for the url attribute

add aws lambda test coverage

bb98334

add test coverage within the wsgi test file

951c408

ericapisani commented Jul 9, 2026

View reviewed changes

ericapisani marked this pull request as ready for review July 9, 2026 22:48

ericapisani requested a review from a team as a code owner July 9, 2026 22:48

ericapisani added 8 commits July 14, 2026 13:43

Make changes to adjust to the data collection option being within the…

d0bae90

… _experiments property in the client

fix test

a6c4688

make sure host header is not filtered when being added to the url

d7b378b

add test coverage for edge case around host header being dropped but …

52c2da1

…still being needed for the url attribute

add aws lambda test coverage

aa645d7

add test coverage within the wsgi test file

d717172

ericapisani force-pushed the py-2584-update-wsgi-filter-headers branch from 951c408 to d717172 Compare July 14, 2026 17:43

Merge branch 'py-2584-update-wsgi-filter-headers' of github.com:getse…

c7f590f

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

sentry Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread sentry_sdk/data_collection.py

Merge branch 'master' into py-2584-update-wsgi-filter-headers

e9f0e20

ericapisani marked this pull request as draft July 15, 2026 19:23

test(aiohttp): Expect single span in streaming passthrough test

3d7bddb

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

ericapisani marked this pull request as ready for review July 15, 2026 19:47

sentry Bot reviewed Jul 16, 2026

View reviewed changes

Merge branch 'master' into py-2584-update-wsgi-filter-headers

ec90ac6

sentry Bot reviewed Jul 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ref(integrations): route HTTP header filtering through data collection config#6788

ref(integrations): route HTTP header filtering through data collection config#6788
ericapisani wants to merge 21 commits into
masterfrom
py-2584-update-wsgi-filter-headers

ericapisani commented Jul 8, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

ericapisani Jul 9, 2026

Uh oh!

Uh oh!

sentry Bot Jul 16, 2026

Uh oh!

sentry Bot Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ericapisani commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear-code Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Results 📊

📊 Comparison with Base Branch

➖ Removed Tests (1)

Uh oh!

Uh oh!

Uh oh!

ericapisani Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sentry Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

sentry Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ericapisani commented Jul 8, 2026 •

edited

Loading

github-actions Bot commented Jul 8, 2026 •

edited

Loading