HTTP Span Attributes: http.url must not contain username / password

[pellared]

As is stated in the recent specification change :

http.url MUST NOT contain credentials passed via URL in form of https://username:password@www.example.com/. In such case the attribute's value should be https://www.example.com/

[codeboten]

Thanks for filing this! Moving this issue to the contrib repo as I don't believe anything in the core repo sets this attribute.

[github-actions]

This issue was marked stale due to lack of activity. It will be closed in 30 days.

[ryokather]

Hi @codeboten is this issue still open? I'd love to take on my first issue and be assigned to it. I noticed that its been fixed in other language implementations but not here yet.

cc: @alolita

[ryokather]

Just wanted to follow up @lzchen or @owais that it's ok to take this on!

[codeboten]

Yup, still open, all yours.

[marcorichetta]

This should be closed, right? @codeboten

[lzchen]

@marcorichetta @ryokather
I believe httpx is the only instrumentation that still needs implementing.

[tammy-baylis-swi]

I found this issue while doing a separate check for if http.url from instrumentation libraries contains sensitive information, so wanted to share some findings.

I agree with @lzchen; the use of remove_url_credentials util by several instrumentation libraries is already sanitizing http.url when written (aiohttp_client, asgi, requests, tornado, urllib, wsgi).

It seems like the httpx instrumentation library isn't exposing passwords but it still exposes usernames. http.url value is protected by HTTPX’s request implementation and URL implementation. Creation of a request like r = httpx.get("http://username:password@0.0.0.0:8000/home/") then calling r.url gives a protected URL('http://username:[secure]@0.0.0.0:8000/home/'), and this is what the instrumentation library's _extract_parameters method uses before its _prepare_attributes method.

[lzchen]

@tammy-baylis-swi
Interesting. If that's the case then simply some tests should be added to confirm that it does indeed solve this problem.