Skip to content

feat(wsgi): Gate client IP/user info behind data_collection config#6858

Merged
ericapisani merged 62 commits into
masterfrom
py-2586-gate_user_data_wsgi
Jul 22, 2026
Merged

feat(wsgi): Gate client IP/user info behind data_collection config#6858
ericapisani merged 62 commits into
masterfrom
py-2586-gate_user_data_wsgi

Conversation

@ericapisani

@ericapisani ericapisani commented Jul 21, 2026

Copy link
Copy Markdown
Member

Apply data_collection.user_info filtering to WSGI handling, mirroring the
ASGI change: gate REMOTE_ADDR capture, client.address/user.ip_address span
attributes, and event user.ip_address behind data_collection, falling back
to send_default_pii when data_collection is not configured.

Also skip installing the default EventScrubber when a data_collection
config is provided, since scrubbing could remove data that config allows,
and warn when an event scrubber is explicitly configured alongside it.

Add parametrized end-to-end tests for WSGI, Django, and Flask covering
data_collection precedence over send_default_pii.

Ref PY-2586
Ref #6746

…n config

`_filter_headers` previously used a hardcoded sensitive-header tuple and a
`send_default_pii`/`use_annotated_value` toggle. It now delegates to
`_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`,
so header scrubbing respects the new `data_collection.http_headers.request`
allowlist/denylist/off configuration.

Cookie and set-cookie headers are
always redacted regardless of mode. Drops the now-unused
`use_annotated_value` parameter from all call sites.

Work to scrub cookies in a more granular way will be tackled as part of
PY-2581/#6741.

Fixes PY-2584
Fixes #6744
…ures

The new lambda_functions_with_embedded_sdk fixture directories were
missing the .gitignore that the other fixtures use to keep everything
except index.py untracked. As a result, certifi and urllib3 packages
installed by the test setup got committed, and ruff failed CI linting
against them since they're unmodified third-party code.

Add the missing .gitignore to each new fixture directory and remove
the committed vendored packages; they are regenerated automatically at
test time via `uv pip install --target`.
…tarlette, litestar, starlite

Extends the granular cookie collection controls (data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.

HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered
with the "[Filtered]" value.

Fixes PY-2581
Fixes #6741
…de is off

Previously the async request extractors attached an empty cookies dict
when the data_collection cookies mode was off, while sync route handlers
omitted it entirely. Make all integrations consistent by not attaching
the cookies field at all when filtering yields no cookies.
…n config

`_filter_headers` previously used a hardcoded sensitive-header tuple and a
`send_default_pii`/`use_annotated_value` toggle. It now delegates to
`_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`,
so header scrubbing respects the new `data_collection.http_headers.request`
allowlist/denylist/off configuration.

Cookie and set-cookie headers are
always redacted regardless of mode. Drops the now-unused
`use_annotated_value` parameter from all call sites.

Work to scrub cookies in a more granular way will be tackled as part of
PY-2581/#6741.

Fixes PY-2584
Fixes #6744
…ures

The new lambda_functions_with_embedded_sdk fixture directories were
missing the .gitignore that the other fixtures use to keep everything
except index.py untracked. As a result, certifi and urllib3 packages
installed by the test setup got committed, and ruff failed CI linting
against them since they're unmodified third-party code.

Add the missing .gitignore to each new fixture directory and remove
the committed vendored packages; they are regenerated automatically at
test time via `uv pip install --target`.
…ntry/sentry-python into py-2584-update-wsgi-filter-headers
…tarlette, litestar, starlite

Extends the granular cookie collection controls (data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.

HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered
with the "[Filtered]" value.

Fixes PY-2581
Fixes #6741
…de is off

Previously the async request extractors attached an empty cookies dict
when the data_collection cookies mode was off, while sync route handlers
omitted it entirely. Make all integrations consistent by not attaching
the cookies field at all when filtering yields no cookies.
The streaming path no longer emits a client span when there is no current
span (#6810), so unpack only the server span.
Filter WSGI request event and span query strings through the
data_collection.url_query_params behaviour (denylist/allowlist/off)
instead of gating query string capture solely on send_default_pii.
This brings WSGI-based integrations in line with the data collection
spec's handling of cookies and headers.

Rename the data_collection field query_params to url_query_params to
match the updated data collection spec, which distinguishes URL query
params from other key-value data (cookies, headers). Update the
DataCollection/DataCollectionUserOptions TypedDicts, resolution logic
in data_collection.py, and all WSGI/Flask/Django test coverage
accordingly.

Refs PY-2583
@ericapisani
ericapisani requested a review from a team as a code owner July 21, 2026 16:11
@linear-code

linear-code Bot commented Jul 21, 2026

Copy link
Copy Markdown

PY-2586

@ericapisani ericapisani changed the title eat(wsgi): Gate client IP/user info behind data_collection config feat(wsgi): Gate client IP/user info behind data_collection config Jul 21, 2026
Comment thread sentry_sdk/client.py
Comment thread sentry_sdk/client.py Outdated
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Codecov Results 📊

95183 passed | ⏭️ 6340 skipped | Total: 101523 | Pass Rate: 93.76% | Execution Time: 332m 23s

📊 Comparison with Base Branch

Metric Change
Total Tests 📈 +845
Passed Tests 📈 +846
Failed Tests 📉 -1
Skipped Tests

➖ Removed Tests (1)

View removed tests
  • test_continuous_profiler_auto_start_and_stop_sampled[non-experiment-thread]
    • File: tests.profiler.test_continuous_profiler

All tests are passing successfully.

✅ Patch coverage is 92.00%. Project has 2515 uncovered lines.
❌ Project coverage is 89.64%. Comparing base (base) to head (head).

Files with missing lines (1)
File Patch % Lines
sentry_sdk/client.py 50.00% ⚠️ 2 Missing and 1 partials
Coverage diff
@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    89.71%    89.64%    -0.07%
==========================================
  Files          193       193         —
  Lines        24226     24269       +43
  Branches      8490      8536       +46
==========================================
+ Hits         21732     21754       +22
- Misses        2494      2515       +21
- Partials      1396      1395        -1

Generated by Codecov Action

Comment thread sentry_sdk/client.py

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit b49ba15. Configure here.

Comment thread .lore.md Outdated
Comment thread sentry_sdk/client.py
@ericapisani
ericapisani force-pushed the py-2586-gate_user_data_wsgi branch from b49ba15 to 18f8b31 Compare July 21, 2026 19:11
Comment thread sentry_sdk/client.py
Base automatically changed from py-2586-gate-user-data to master July 22, 2026 19:25
@ericapisani
ericapisani merged commit 5ddb8a2 into master Jul 22, 2026
141 checks passed
@ericapisani
ericapisani deleted the py-2586-gate_user_data_wsgi branch July 22, 2026 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants