Skip to content

Define declarative configuration path for sensitive_query_parameters#3403

Open
trask wants to merge 1 commit intoopen-telemetry:mainfrom
trask:sensitive-query-parameters
Open

Define declarative configuration path for sensitive_query_parameters#3403
trask wants to merge 1 commit intoopen-telemetry:mainfrom
trask:sensitive-query-parameters

Conversation

@trask
Copy link
Member

@trask trask commented Feb 5, 2026

Similar to

This property doesn't have any precedent for naming, so would be worth considering other options besides sensitive_query_parameters.

cc @open-telemetry/configuration-approvers

@trask trask force-pushed the sensitive-query-parameters branch from f82e10a to 1de903d Compare February 5, 2026 18:48
@trask trask force-pushed the sensitive-query-parameters branch from 1de903d to 89bf0d9 Compare February 5, 2026 18:50
@github-actions github-actions bot added enhancement New feature or request area:http labels Feb 5, 2026
@trask trask marked this pull request as ready for review February 5, 2026 18:51
@trask trask requested review from a team as code owners February 5, 2026 18:51
![Development](https://img.shields.io/badge/-development-blue)
HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
Copy link
Member

@lmolkova lmolkova Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there are other instrumentation that may populate url.full or url.query (e.g. elasticsearch does) - do we expect each of these instrumentations to define the section?

Alternative:

general:
  sanitization:
    url:
      sensitive_query_parameters: []
    enduser:  # imaginary future
       id_obfuscation_algo:

There will also be more sanitization options, it kind of makes sense to group them together under sanitization section and then by attribute key/namespace rather than by instrumentation.

It does not affect HTTP headers or methods much because they are HTTP-specific anyway

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants