Make changes to adjust to the data collection option being within the _experiments property in the client

ericapisani · ericapisani · commit a590c8ece1d8 · 2026-07-09T10:45:38.000-04:00
diff --git a/sentry_sdk/integrations/_asgi_common.py b/sentry_sdk/integrations/_asgi_common.py
@@ -117,6 +117,7 @@ def _get_request_data(
 
         request_data["headers"] = headers = _filter_headers(
             _get_headers(asgi_scope),
+            use_annotated_value=False,
         )
         request_data["query_string"] = _get_query(asgi_scope)
 
diff --git a/sentry_sdk/integrations/_wsgi_common.py b/sentry_sdk/integrations/_wsgi_common.py
@@ -6,7 +6,7 @@
 from sentry_sdk._types import SENSITIVE_DATA_SUBSTITUTE
 from sentry_sdk.data_collection import _apply_key_value_collection_filtering
 from sentry_sdk.scope import should_send_default_pii
-from sentry_sdk.utils import AnnotatedValue, logger
+from sentry_sdk.utils import AnnotatedValue, has_data_collection_enabled, logger
 
 try:
     from django.http.request import RawPostDataException
@@ -23,6 +23,21 @@
 
     from sentry_sdk._types import Event, HttpStatusCodeRange
 
+SENSITIVE_ENV_KEYS = (
+    "REMOTE_ADDR",
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_SET_COOKIE",
+    "HTTP_COOKIE",
+    "HTTP_AUTHORIZATION",
+    "HTTP_PROXY_AUTHORIZATION",
+    "HTTP_X_API_KEY",
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_X_REAL_IP",
+)
+
+SENSITIVE_HEADERS = tuple(
+    x[len("HTTP_") :] for x in SENSITIVE_ENV_KEYS if x.startswith("HTTP_")
+)
 
 DEFAULT_HTTP_METHODS_TO_CAPTURE = (
     "CONNECT",
@@ -196,19 +211,41 @@ def _is_json_content_type(ct: "Optional[str]") -> bool:
 
 def _filter_headers(
     headers: "Mapping[str, str]",
-) -> "Mapping[str, str]":
-    data_collection_configuration = sentry_sdk.get_client().options["data_collection"]
+    use_annotated_value: bool = True,
+) -> "Mapping[str, Union[str, AnnotatedValue]]":
+    client_options = sentry_sdk.get_client().options
 
-    filtered = _apply_key_value_collection_filtering(
-        items=headers,
-        behaviour=data_collection_configuration["http_headers"]["request"],
-    )
+    if has_data_collection_enabled(client_options):
+        data_collection_configuration = client_options["data_collection"]
 
-    for key in filtered:
-        if isinstance(key, str) and key.lower() in ("cookie", "set-cookie"):
-            filtered[key] = SENSITIVE_DATA_SUBSTITUTE
+        filtered = _apply_key_value_collection_filtering(
+            items=headers,
+            behaviour=data_collection_configuration["http_headers"]["request"],
+        )
 
-    return filtered
+        for key in filtered:
+            if isinstance(key, str) and key.lower() in ("cookie", "set-cookie"):
+                filtered[key] = SENSITIVE_DATA_SUBSTITUTE
+
+        return filtered
+    else:
+        if should_send_default_pii():
+            return headers
+
+        substitute: "Union[AnnotatedValue, str]" = (
+            SENSITIVE_DATA_SUBSTITUTE
+            if not use_annotated_value
+            else AnnotatedValue.removed_because_over_size_limit()
+        )
+
+        return {
+            k: (
+                v
+                if k.upper().replace("-", "_") not in SENSITIVE_HEADERS
+                else substitute
+            )
+            for k, v in headers.items()
+        }
 
 
 def _in_http_status_code_range(
diff --git a/sentry_sdk/integrations/aiohttp.py b/sentry_sdk/integrations/aiohttp.py
@@ -150,7 +150,8 @@ async def sentry_app_handle(
 
                         header_attributes: "dict[str, Any]" = {}
                         for header, header_value in _filter_headers(
-                            headers
+                            headers,
+                            use_annotated_value=False,
                         ).items():
                             header_attributes[
                                 f"http.request.header.{header.lower()}"
diff --git a/sentry_sdk/integrations/aws_lambda.py b/sentry_sdk/integrations/aws_lambda.py
@@ -152,7 +152,7 @@ def sentry_handler(
 
             header_attributes: "dict[str, Any]" = {}
             for header, header_value in _filter_headers(
-                headers
+                headers, use_annotated_value=False
             ).items():
                 header_attributes[f"http.request.header.{header.lower()}"] = (
                     header_value
diff --git a/sentry_sdk/integrations/chalice.py b/sentry_sdk/integrations/chalice.py
@@ -92,7 +92,7 @@ def wrapped_view_function(**function_args: "Any") -> "Any":
 
                     header_attrs: "Dict[str, Any]" = {}
                     for header, value in _filter_headers(
-                        headers
+                        headers, use_annotated_value=False
                     ).items():
                         header_attrs[f"http.request.header.{header.lower()}"] = value
 
diff --git a/sentry_sdk/integrations/gcp.py b/sentry_sdk/integrations/gcp.py
@@ -89,7 +89,7 @@ def sentry_func(
             if hasattr(gcp_event, "headers"):
                 headers = gcp_event.headers
                 for header, header_value in _filter_headers(
-                    headers
+                    headers, use_annotated_value=False
                 ).items():
                     header_attributes[f"http.request.header.{header.lower()}"] = (
                         # header_value will always be a string because we set `use_annotated_value` to false above
diff --git a/sentry_sdk/integrations/quart.py b/sentry_sdk/integrations/quart.py
@@ -195,7 +195,7 @@ async def _request_websocket_started(app: "Quart", **kwargs: "Any") -> None:
             header_attributes: "dict[str, Any]" = {}
 
             for header, header_value in _filter_headers(
-                dict(request_websocket.headers)
+                dict(request_websocket.headers), use_annotated_value=False
             ).items():
                 header_attributes[f"http.request.header.{header.lower()}"] = (
                     header_value
diff --git a/sentry_sdk/integrations/sanic.py b/sentry_sdk/integrations/sanic.py
@@ -374,7 +374,7 @@ def _get_request_attributes(request: "Request") -> "Dict[str, Any]":
     if request.method:
         attributes[SPANDATA.HTTP_REQUEST_METHOD] = request.method.upper()
 
-    headers = _filter_headers(dict(request.headers))
+    headers = _filter_headers(dict(request.headers), use_annotated_value=False)
     for header, value in headers.items():
         attributes[f"{SPANDATA.HTTP_REQUEST_HEADER}.{header.lower()}"] = value
 
diff --git a/sentry_sdk/integrations/tornado.py b/sentry_sdk/integrations/tornado.py
@@ -193,7 +193,7 @@ def _get_request_attributes(request: "Any") -> "Dict[str, Any]":
     if request.method:
         attributes[SPANDATA.HTTP_REQUEST_METHOD] = request.method.upper()
 
-    headers = _filter_headers(dict(request.headers))
+    headers = _filter_headers(dict(request.headers), use_annotated_value=False)
     for header, value in headers.items():
         attributes[f"{SPANDATA.HTTP_REQUEST_HEADER}.{header.lower()}"] = value
 
diff --git a/sentry_sdk/integrations/wsgi.py b/sentry_sdk/integrations/wsgi.py
@@ -390,7 +390,7 @@ def _get_request_attributes(
     if method:
         attributes["http.request.method"] = method.upper()
 
-    headers = _filter_headers(dict(_get_headers(environ)))
+    headers = _filter_headers(dict(_get_headers(environ)), use_annotated_value=False)
     for header, value in headers.items():
         attributes[f"http.request.header.{header.lower()}"] = value
 
diff --git a/tests/integrations/aiohttp/test_aiohttp.py b/tests/integrations/aiohttp/test_aiohttp.py
@@ -1379,8 +1379,10 @@ async def test_sensitive_header_passthrough_with_pii_span_streaming(
         integrations=[AioHttpIntegration()],
         traces_sample_rate=1.0,
         send_default_pii=options["send_default_pii"],
-        data_collection=options["data_collection"],
-        _experiments={"trace_lifecycle": "stream"},
+        _experiments={
+            "trace_lifecycle": "stream",
+            "data_collection": options["data_collection"],
+        },
     )
 
     async def hello(request):
@@ -1433,6 +1435,43 @@ async def hello(request):
         assert "client.address" not in server_span["attributes"]
 
 
+@pytest.mark.asyncio
+async def test_sensitive_header_passthrough_with_pii_span_streaming_without_data_collection(
+    sentry_init, aiohttp_client, capture_items
+):
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        traces_sample_rate=1.0,
+        send_default_pii=True,
+        _experiments={"trace_lifecycle": "stream"},
+    )
+
+    async def hello(request):
+        return web.Response(text="hello")
+
+    app = web.Application()
+    app.router.add_get("/", hello)
+
+    items = capture_items("span")
+
+    client = await aiohttp_client(app)
+    await client.get("/", headers={"Authorization": "Bearer secret-token"})
+
+    sentry_sdk.flush()
+
+    server_span, _client_segment = [item.payload for item in items]
+
+    # With send_default_pii=True, _filter_headers is a no-op and the original
+    # value reaches the span attribute.
+    assert (
+        server_span["attributes"]["http.request.header.authorization"]
+        == "Bearer secret-token"
+    )
+    # client.address and user.ip_address is captured under send_default_pii=True.
+    assert server_span["attributes"]["client.address"] == "127.0.0.1"
+    assert server_span["attributes"]["user.ip_address"] == "127.0.0.1"
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("send_pii", [True, False])
 async def test_url_query_attribute_span_streaming(
diff --git a/tests/integrations/quart/test_quart.py b/tests/integrations/quart/test_quart.py
@@ -7,6 +7,7 @@
 import pytest
 
 import sentry_sdk
+from sentry_sdk._types import SENSITIVE_DATA_SUBSTITUTE
 import sentry_sdk.integrations.quart as quart_sentry
 from sentry_sdk import (
     capture_exception,
@@ -981,8 +982,10 @@ async def test_span_streaming_sensitive_header_scrubbing(
         integrations=[quart_sentry.QuartIntegration()],
         traces_sample_rate=1.0,
         send_default_pii=options["send_default_pii"],
-        data_collection=options["data_collection"],
-        _experiments={"trace_lifecycle": "stream"},
+        _experiments={
+            "trace_lifecycle": "stream",
+            "data_collection": options["data_collection"],
+        },
     )
     items = capture_items("span")
 
@@ -1019,6 +1022,42 @@ async def test_span_streaming_sensitive_header_scrubbing(
         assert segment["attributes"]["http.request.header.cookie"] == expected["cookie"]
 
 
+@pytest.mark.asyncio
+async def test_span_streaming_sensitive_header_without_data_collection(
+    sentry_init, capture_items
+):
+    sentry_init(
+        integrations=[quart_sentry.QuartIntegration()],
+        traces_sample_rate=1.0,
+        send_default_pii=False,
+        _experiments={"trace_lifecycle": "stream"},
+    )
+    items = capture_items("span")
+
+    app = quart_app_factory()
+    client = app.test_client()
+    response = await client.get(
+        "/message",
+        headers={
+            "Authorization": "Bearer secret-token",
+            "X-Custom-Header": "passthrough",
+        },
+    )
+    assert response.status_code == 200
+
+    sentry_sdk.flush()
+
+    spans = [item.payload for item in items]
+    assert len(spans) == 1
+
+    segment = spans[0]
+    assert (
+        segment["attributes"]["http.request.header.authorization"]
+        == SENSITIVE_DATA_SUBSTITUTE
+    )
+    assert segment["attributes"]["http.request.header.x-custom-header"] == "passthrough"
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("send_default_pii", [True, False])
 @pytest.mark.parametrize("user_id", [None, "42"])
@@ -1060,3 +1099,35 @@ async def login():
         assert segment["attributes"]["user.id"] == user_id
     else:
         assert "user.id" not in segment.get("attributes", {})
+
+
+@pytest.mark.asyncio
+async def test_span_streaming_sensitive_header_passthrough_with_pii_and_no_data_collection(
+    sentry_init, capture_items
+):
+    sentry_init(
+        integrations=[quart_sentry.QuartIntegration()],
+        traces_sample_rate=1.0,
+        send_default_pii=True,
+        _experiments={"trace_lifecycle": "stream"},
+    )
+    items = capture_items("span")
+
+    app = quart_app_factory()
+    client = app.test_client()
+    response = await client.get(
+        "/message",
+        headers={"Authorization": "Bearer secret-token"},
+    )
+    assert response.status_code == 200
+
+    sentry_sdk.flush()
+
+    spans = [item.payload for item in items]
+    assert len(spans) == 1
+
+    segment = spans[0]
+    assert (
+        segment["attributes"]["http.request.header.authorization"]
+        == "Bearer secret-token"
+    )

Original file line number	Diff line number	Diff line change
`@@ -117,6 +117,7 @@ def _get_request_data(`
`117`	`117`
`118`	`118`	`request_data["headers"] = headers = _filter_headers(`
`119`	`119`	`_get_headers(asgi_scope),`
	`120`	`+ use_annotated_value=False,`
`120`	`121`	`)`
`121`	`122`	`request_data["query_string"] = _get_query(asgi_scope)`
`122`	`123`