Part of #5420. Phase 0 — hardening pre-work, no new public API.
Today only Authorization and Proxy-Authorization header values are redacted (src/Sentry/Internal/RedactedHeaders.cs, SentryRequest.AddHeaders, Protocol/Response.AddHeaders), and only in some paths. Apply the full sensitive-terms denylist filter to header values unconditionally — regardless of SendDefaultPii — in:
src/Sentry/SentryRequest.cs / src/Sentry/Protocol/Response.cs (AddHeaders)src/Sentry.AspNetCore/ScopeExtensions.cs (request header capture)src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cssrc/Sentry/SentryHttpFailedRequestHandler.cs / SentryGraphQLHttpFailedRequestHandler.cs
Key names are kept; values become [Filtered]. Depends on the denylist/filter utility issue.
JS reference: getsentry/sentry-javascript#18311 (shipped standalone in 10.27.0, well before the option existed).
Part of #5420. Phase 0 — hardening pre-work, no new public API.
Today only
AuthorizationandProxy-Authorizationheader values are redacted (src/Sentry/Internal/RedactedHeaders.cs,SentryRequest.AddHeaders,Protocol/Response.AddHeaders), and only in some paths. Apply the full sensitive-terms denylist filter to header values unconditionally — regardless ofSendDefaultPii— in:src/Sentry/SentryRequest.cs/src/Sentry/Protocol/Response.cs(AddHeaders)src/Sentry.AspNetCore/ScopeExtensions.cs(request header capture)src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cssrc/Sentry/SentryHttpFailedRequestHandler.cs/SentryGraphQLHttpFailedRequestHandler.csKey names are kept; values become
[Filtered]. Depends on the denylist/filter utility issue.JS reference: getsentry/sentry-javascript#18311 (shipped standalone in 10.27.0, well before the option existed).