iframe-proxy

adinauer · 2026-07-22T07:01:01Z

PR Stack (Data Collection)

📜 Description

Apply the cookie Data Collection policy to automatically captured request and response cookies.

The policy is used by Spring MVC/WebFlux, OkHttp, Ktor, and Apollo 3/4 failed-request events. Explicit Data Collection supports off, deny-list, and allow-list behavior. Built-in sensitive cookie names and Spring integration-provided session cookie names are always filtered, including when allow-listed. Set-Cookie values are parsed separately so attributes such as Path, HttpOnly, and SameSite are preserved.

When Data Collection is absent, integrations preserve their existing sendDefaultPii behavior, including Spring's legacy security-cookie filtering and raw HTTP-client cookie values.

💡 Motivation and Context

Cookie collection previously relied on sendDefaultPii as an on/off gate, with filtering only in Spring integrations. This wires the existing dataCollection.cookies option across cookie capture paths and provides consistent explicit-mode filtering without changing the legacy bridge for applications that have not configured Data Collection.

Refs #5666

💚 How did you test it?

./gradlew spotlessApply apiDump
./gradlew :sentry:apiCheck
Core cookie filtering tests
OkHttp and Ktor failed-request tests
Spring, Spring Jakarta, and Spring 7 request tests
Apollo 3 and Apollo 4 test suites
git diff --check

📝 Checklist

I added GH Issue ID & Linear ID
I added tests to verify the changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed.
I updated the wizard if needed.
Review from the native team if needed.
No breaking change or entry added to the changelog.
No breaking change for hybrid SDKs or communicated to hybrid SDKs.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Complete the remaining Data Collection configuration, documentation, and migration work.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

Filter automatically captured request and response cookies according to the Data Collection policy across Spring and HTTP client integrations. Preserve existing sendDefaultPii behavior when Data Collection is absent. Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2026-07-22T07:01:50Z

sentry · 2026-07-22T07:05:38Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.55.0 (1)	release

⚙️ sentry-android Build Distribution Settings

github-actions · 2026-07-22T07:09:09Z

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	387.14 ms	447.16 ms	60.02 ms
Size	0 B	0 B	0 B

Baseline results on branch: feat/data-collection-query-params

Startup times

Revision	Plain	With Sentry	Diff
`adae5de`	372.16 ms	476.20 ms	104.04 ms

App size

Revision	Plain	With Sentry	Diff
`adae5de`	0 B	0 B	0 B

Previous results on branch: feat/data-collection-cookies

Startup times

Revision	Plain	With Sentry	Diff
`670b3d8`	329.76 ms	371.15 ms	41.39 ms
`df76abc`	308.28 ms	356.24 ms	47.96 ms
`b0be236`	316.30 ms	372.60 ms	56.30 ms

App size

Revision	Plain	With Sentry	Diff
`670b3d8`	0 B	0 B	0 B
`df76abc`	0 B	0 B	0 B
`b0be236`	0 B	0 B	0 B

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

…ction-cookies

github-actions · 2026-08-10T12:42:30Z

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

This PR will not appear in the changelog.

_{🤖 This preview updates automatically when you update the PR.}

…ction-cookies

Validate cookie names and values before applying Data Collection filters. Fail closed for malformed values that could embed additional sensitive cookie pairs while preserving valid quoted and padded values. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode

added some comments!

runningcode · 2026-09-02T14:37:48Z

+            filterCookie(cookieValues[i], behavior, additionalSensitiveCookieNames));
+      }
+      return filteredCookies.toString();
+    } catch (Throwable ignored) {


This should probably catch something narrower otherwise we have no way of knowing that this code is working or not.
We also shouldn't be catching exceptions like OutOfMemoryError or StackOverflowError as the jvm is already in a bad state and ignoring it will leave the JVM in a worse state.

runningcode · 2026-09-02T14:38:57Z

    return filteredQuery.toString();
  }

+  public static @Nullable List<String> filterCookiesFromHeader(


Two nits:

Can we move all the cookie related methods to a Cookies.java? I feel HttpUtils.java is getting too long. This also makes the methods more idiomatic. Cookies.filterFromHeader() reads more naturally to me than HttpUtils.filterCookiesFromHeader()

Can we declare all of these as @ApiUsage.Internal or are they intended to be customer facing?

sure

the whole class is marked internal already so no need to add it to every method:

@ApiStatus.Internal public final class HttpUtils {

runningcode · 2026-09-02T14:47:54Z

+    return filteredHeaders;
+  }
+
+  public static @Nullable String filterCookies(


can you add a test for trailing spaces in cookies ?
my clanker tells me this would add a [Filtered] because of the way split is called.

runningcode · 2026-09-02T14:48:26Z

+
+    final @NotNull List<String> filteredHeaders = new ArrayList<>();
+    for (final String header : headers) {
+      filteredHeaders.add(filterCookies(header, behavior, additionalSensitiveCookieNames));


this can add null items in to the list since filterCookies is @Nullable

Avoid adding nullable filter results to cookie header lists so downstream consumers only receive actual header values. Co-Authored-By: Claude <noreply@anthropic.com>

Keep empty and whitespace-only cookie segments unchanged instead of replacing them with a filtered marker. Co-Authored-By: Claude <noreply@anthropic.com>

Let unexpected implementation errors remain visible instead of swallowing fatal JVM errors during deterministic cookie parsing. Co-Authored-By: Claude <noreply@anthropic.com>

Move cookie parsing and filtering into a focused internal utility and update integrations to use it. Keep generic query and header filtering in HttpUtils. Co-Authored-By: Claude <noreply@anthropic.com>

Merge the latest main and landed Data Collection changes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

Exercise response cookie filtering with a valid cookie and preserve its attributes in the expected output. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode · 2026-09-07T15:09:32Z

+import org.jetbrains.annotations.Nullable;
+
+@ApiStatus.Internal
+public final class CookieUtils {


Thanks for adding this new class! I think it helps separate the code well.

runningcode · 2026-09-07T15:14:34Z

+      final @Nullable Enumeration<String> headers,
+      final @Nullable String headerName,
+      final @Nullable List<String> additionalCookieNamesToFilter) {
+    if (headers == null) {


This is redundant since the next line does the same thing.

runningcode · 2026-09-07T15:26:57Z

    scopes.captureEvent(event, hint)
  }

+  private fun getRequestCookies(scopes: IScopes, cookies: String?): String? =


All of the getRequestCookies and getResponseCookies are copy pasted. Can we move them in to the Cookies.java class to reduce the copy/paste?

runningcode

pre-emptively giving a ✅ let me know if you'd like another review.

This was referenced Jul 22, 2026

feat(core): Data Collection #5759

Draft

feat(core): [Data Collection 1] Add configuration types #5760

Merged

feat(core): [Data Collection 2] Expose SentryOptions API #5761

Merged

adinauer mentioned this pull request Jul 22, 2026

feat(user): [Data Collection 14] Apply user information policy #5812

Draft

9 tasks

adinauer and others added 2 commits July 23, 2026 10:30

fix(core): Filter malformed cookie pairs

1987b1e

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

test(okhttp): Return headers from response mocks

9da9baa

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

ccfe195

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

d7a900d

…ction-cookies

adinauer mentioned this pull request Aug 12, 2026

fix(android): [Data Collection 19] Preserve installation ID #5937

Draft

9 tasks

This was referenced Aug 24, 2026

Capture all repeated Cookie and Set-Cookie header values #5982

Open

fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983

Draft

merge: Update Data Collection stack

501c268

adinauer mentioned this pull request Aug 25, 2026

fix(opentelemetry): [Data Collection 21] Exclude queries from span descriptions #5985

Closed

9 tasks

adinauer added 4 commits August 27, 2026 14:51

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

988579b

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

c4e29eb

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

b9eeeb5

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

71619ec

…ction-cookies

adinauer mentioned this pull request Sep 1, 2026

feat(core): [Data Collection 21] Add external configuration #6036

Draft

8 tasks

lbloder reviewed Sep 1, 2026

View reviewed changes

Comment thread sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientUtils.kt

lbloder reviewed Sep 1, 2026

View reviewed changes

Comment thread sentry/src/main/java/io/sentry/util/HttpUtils.java Outdated

adinauer mentioned this pull request Sep 2, 2026

feat(android): [Data Collection 22] Add manifest configuration #6038

Draft

8 tasks

Base automatically changed from feat/data-collection-query-params to feat/data-collection September 2, 2026 12:24

chore: Merge data collection base into cookie filtering

6cdd40e

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode reviewed Sep 2, 2026

View reviewed changes

adinauer and others added 5 commits September 7, 2026 07:07

fix(core): Skip null filtered cookie headers

489982d

Avoid adding nullable filter results to cookie header lists so downstream consumers only receive actual header values. Co-Authored-By: Claude <noreply@anthropic.com>

fix(core): Preserve blank cookie segments

6900fba

Keep empty and whitespace-only cookie segments unchanged instead of replacing them with a filtered marker. Co-Authored-By: Claude <noreply@anthropic.com>

ref(core): Remove broad cookie filtering catches

3315b18

Let unexpected implementation errors remain visible instead of swallowing fatal JVM errors during deterministic cookie parsing. Co-Authored-By: Claude <noreply@anthropic.com>

ref(core): Extract cookie utilities from HTTP utilities

b11dcdd

Move cookie parsing and filtering into a focused internal utility and update integrations to use it. Keep generic query and header filtering in HttpUtils. Co-Authored-By: Claude <noreply@anthropic.com>

chore: Merge Data Collection branch updates

6a03c1f

Merge the latest main and landed Data Collection changes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

adinauer mentioned this pull request Sep 7, 2026

fix(core): [Data Collection 23] Support WebSocket URL parsing #6064

Draft

9 tasks

test(okhttp): Use valid Set-Cookie fixture

33078e4

Exercise response cookie filtering with a valid cookie and preserve its attributes in the expected output. Co-Authored-By: Claude <noreply@anthropic.com>

adinauer mentioned this pull request Sep 7, 2026

fix(core): [Data Collection 24] Narrow utility exception handling #6065

Draft

9 tasks

runningcode reviewed Sep 7, 2026

View reviewed changes

runningcode approved these changes Sep 7, 2026

View reviewed changes

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Uh oh!

Conversation

adinauer commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Stack (Data Collection)

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sentry Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance metrics 🚀

Baseline results on branch: feat/data-collection-query-params

Startup times

App size

Previous results on branch: feat/data-collection-cookies

Startup times

App size

Uh oh!

github-actions Bot commented Aug 10, 2026

Semver Impact of This PR

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

runningcode left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

runningcode left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adinauer commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading

sentry Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading