getsentry / getsentry/sentry-javascript
Sensitive values bypass the denylist in header and cookie collection
Open
javascript
- Dominant language
- TypeScript
- Stars
- 8.7k
- Forks
- 1.8k
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 515
Description
A cookie header that cannot be split into `name=value` pairs ends up verbatim in an attribute key, and headers listed in `headersToSpanAttributes` skip the denylist, so an `authorization` header is sent in the clear.
Contributor guide
Assessment
This issue has not been assessed yet.