feat(integrations): apply data_collection cookie filtering to wsgi, starlette, litestar, starlite#6797
Conversation
…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744
… _experiments property in the client
…still being needed for the url attribute
…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.
…tarlette, litestar, starlite Extends the granular cookie collection controls (data_collection.cookies) to _wsgi_common, starlette, litestar, and starlite, matching the behavior already used elsewhere. Falls back to should_send_default_pii() when data_collection is not configured for cookies. HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered with the "[Filtered]" value. Fixes PY-2581 Fixes #6741
| request_info = event.get("request", {}) | ||
| if info: | ||
| if "cookies" in info and should_send_default_pii(): | ||
| if "cookies" in info: |
There was a problem hiding this comment.
the should_send_default_pii check here is no longer needed since this check happens within StarletteRequestExtractor
There was a problem hiding this comment.
Been some time since I last looked at the extractor code -- so the Starlette extractor runs after this and overwrites the cookies?
Just wanted to double-check that we have the precedence right (and that the cookies are really missing if should_send_default_pii=False after this change)
There was a problem hiding this comment.
Been some time since I last looked at the extractor code -- so the Starlette extractor runs after this and overwrites the cookies?
It runs before this, and then, yes, overwrites the cookies.
If should_send_default_pii is false or if the data collection configuration filters out cookies, then the cookies key/value doesn't get set on info within the Starlette extractor's extract_request_info (and line 121 doesn't run).
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Codecov Results 📊✅ 92977 passed | ⏭️ 6304 skipped | Total: 99281 | Pass Rate: 93.65% | Execution Time: 323m 41s 📊 Comparison with Base Branch
All tests are passing successfully. ✅ Patch coverage is 96.88%. Project has 2478 uncovered lines. Files with missing lines (3)
Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 89.71% 89.72% +0.01%
==========================================
Files 193 193 —
Lines 24080 24103 +23
Branches 8384 8402 +18
==========================================
+ Hits 21602 21625 +23
- Misses 2478 2478 —
- Partials 1388 1388 —Generated by Codecov Action |
…de is off Previously the async request extractors attached an empty cookies dict when the data_collection cookies mode was off, while sync route handlers omitted it entirely. Make all integrations consistent by not attaching the cookies field at all when filtering yields no cookies.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 620e222. Configure here.
…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744
… _experiments property in the client
…still being needed for the url attribute
…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.
951c408 to
d717172
Compare
ec6f520 to
0396813
Compare
…ntry/sentry-python into py-2584-update-wsgi-filter-headers
…tarlette, litestar, starlite Extends the granular cookie collection controls (data_collection.cookies) to _wsgi_common, starlette, litestar, and starlite, matching the behavior already used elsewhere. Falls back to should_send_default_pii() when data_collection is not configured for cookies. HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered with the "[Filtered]" value. Fixes PY-2581 Fixes #6741
…de is off Previously the async request extractors attached an empty cookies dict when the data_collection cookies mode was off, while sync route handlers omitted it entirely. Make all integrations consistent by not attaching the cookies field at all when filtering yields no cookies.
0396813 to
326d796
Compare
The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.
sentrivana
left a comment
sentrivana
left a comment
There was a problem hiding this comment.
Looks good! Had a small question regarding the event processor and the NO_COOKIES sentinel in the tests.
| request_info = event.get("request", {}) | ||
| if info: | ||
| if "cookies" in info and should_send_default_pii(): | ||
| if "cookies" in info: |
There was a problem hiding this comment.
Been some time since I last looked at the extractor code -- so the Starlette extractor runs after this and overwrites the cookies?
Just wanted to double-check that we have the precedence right (and that the cookies are really missing if should_send_default_pii=False after this change)
Use None instead of a dedicated sentinel object in cookie data collection tests for Django, Starlette, Starlite, Litestar, and Tornado.
2 participants
Extends the granular cookie collection controls (data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.
HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered
with the "[Filtered]" value.
Fixes PY-2581
Fixes #6741