Skip to content

Define declarative configuration path for sensitive_query_parameters #3403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
trask wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Define declarative configuration path for sensitive_query_parameters #3403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .chloggen/sensitive-query-parameters-declarative-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
change_type: enhancement
component: http
note: Define declarative configuration for sensitive query parameters.
issues: [3403]
7 changes: 7 additions & 0 deletions docs/db/elasticsearch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,13 @@ value `REDACTED`:

This list is subject to change over time.

![Development](https://img.shields.io/badge/-development-blue)
HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
Copy link
Member

@lmolkova lmolkova Feb 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there are other instrumentation that may populate url.full or url.query (e.g. elasticsearch does) - do we expect each of these instrumentations to define the section?

Alternative:

general:
  sanitization:
    url:
      sensitive_query_parameters: []
    enduser:  # imaginary future
       id_obfuscation_algo:

There will also be more sanitization options, it kind of makes sense to group them together under sanitization section and then by attribute key/namespace rather than by instrumentation.

It does not affect HTTP headers or methods much because they are HTTP-specific anyway

This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`https://www.example.com/path?color=blue&sig=REDACTED`.

Expand Down
13 changes: 13 additions & 0 deletions docs/http/http-spans.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,13 @@ value `REDACTED`:

This list is subject to change over time.

![Development](https://img.shields.io/badge/-development-blue)
HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`https://www.example.com/path?color=blue&sig=REDACTED`.

Expand Down Expand Up @@ -547,6 +554,12 @@ Query string values for the following keys SHOULD be redacted by default and rep

This list is subject to change over time.

HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`q=OpenTelemetry&sig=REDACTED`.

Expand Down
13 changes: 13 additions & 0 deletions docs/registry/attributes/url.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,13 @@ value `REDACTED`:

This list is subject to change over time.

![Development](https://img.shields.io/badge/-development-blue)
HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`https://www.example.com/path?color=blue&sig=REDACTED`.

Expand All @@ -70,6 +77,12 @@ Query string values for the following keys SHOULD be redacted by default and rep

This list is subject to change over time.

HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`q=OpenTelemetry&sig=REDACTED`.

Expand Down
13 changes: 13 additions & 0 deletions model/url/registry.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,13 @@ groups:

This list is subject to change over time.

![Development](https://img.shields.io/badge/-development-blue)
HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`https://www.example.com/path?color=blue&sig=REDACTED`.
examples:
Expand Down Expand Up @@ -115,6 +122,12 @@ groups:

This list is subject to change over time.

HTTP instrumentation MAY provide a way to override this list via declarative configuration.
If so, it SHOULD use the `sensitive_query_parameters` property
(an array of strings with minimum items 0) under `.instrumentation/development.general.http`.
This list is a full override of the default sensitive query parameter keys,
it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g.
`q=OpenTelemetry&sig=REDACTED`.
- id: url.registered_domain
Expand Down
Loading