feat: sanitize URLs + semantic conventions for header attributes

[ccschmitz-launchdarkly]

Summary

• Sanitizes URLs to redact sensitive keys in query params and username/password credentials
• Adds response headers as span attributes
• Updates all header span attribute assignment to follow semantic conventions
• Ensures config for body/headers to record/redact is respected on requests and responses

How did you test this change?

Click tested with the new page on the E2E app.

• Single + array values as headers
• AWS key query param redacted
• Username/password params redacted

Are there any deployment considerations?

N/A

---

Note

Sanitizes URLs (credentials and sensitive query params) and records request/response headers and bodies as OTel-compliant span attributes, plus adds an E2E HTTP test page and extensive tests.

• SDK/OTel:
  • Sanitize and set http.url/url.full/url.path/url.query using new sanitizeUrl/safeParseUrl.
  • Conditionally record request/response bodies and headers when networkRecordingOptions.recordHeadersAndBody is enabled.
  • Add response header capture; convert headers to OTel attributes via http.request.header.* / http.response.header.* with correct array handling (splitHeaderValue).
  • Sanitize Web Vitals URL attributes in observe.ts.
  • Use getUrlFromSpan and shouldRecordRequest in propagator; handle non-Response fetch results.
• Network Sanitization Utils:
  • Add safeParseUrl, sanitizeUrl, sensitive query param redaction, and defaults; export blocklist constants.
• Helpers:
  • Add parseXhrResponseHeaders, convertHeadersToOtelAttributes, splitHeaderValue.
• E2E App:
  • Add routes/http-test.tsx and route /http-test with buttons to exercise header/url/body scenarios; link in root nav.
• Tests:
  • New instrumentation.test.ts covering URL sanitization, header conversion/splitting, XHR header parsing, and header/body recording behavior.

^{Written by Cursor Bugbot for commit 71efe38. This will update automatically on new commits. Configure here.}

[ntiner1]

Cursor comments seem real, 1 suggestion, otherwise looks good

🥇