Add an option for masking query parameters
- Dominant language
- Gherkin
- Stars
- 427
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
The agent has an option to mask sensitive data from headers (filterHttpHeaders); there is no such option for query parameters. It is a common approach to pass things like "key" or "access_token" via query.
**Describe the solution you'd like**
The agent should provide an option for masking specified query parameters.
**Describe alternatives you've considered**
Writing a custom filter:
```
function maskQuery (url, fields, mask = 'REDACTED') {
const params = new URL(url.full).searchParams;
const pair = (field, value) => querystring.stringify({ [field]: value });
// replace field= with field=REDACTED
const maskField = field => {
params.getAll(field).forEach(value => {
const [substr, newstr] = [pair(field, value), pair(field, mask)];
['raw', 'search', 'full'].forEach(member => {
url[member] = url[member].replace(substr, newstr);
});
});
};
fields.forEach(maskField);
return url;
}
function transactionFilterQuery (report) {
if (report.context && report.context.request) {
try {
maskQuery(report.context.request.url, ['access_token']);
} catch (error) {
logger.error(`URL parsing error: ${JSON.stringify(error)}`);
report = null;
}
}
return report;
}
apm.addTransactionFilter(transactionFilterQuery);
```
This, however, needs to be duplicated in every service, requires the URL to be parsed again, and is not very robust. It would be nice to have this functionality provided by the agent directly.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.