Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address high-cardinality attributes server.address and server.port attack vector #108

Closed
trask opened this issue Jun 14, 2023 · 0 comments · Fixed by #109
Closed

Address high-cardinality attributes server.address and server.port attack vector #108

trask opened this issue Jun 14, 2023 · 0 comments · Fixed by #109
Assignees

Comments

@trask
Copy link
Member

trask commented Jun 14, 2023

As pointed out in by @joaopgrassi and team in #17 (comment).

The metric attributes server.address and server.port on the http.server.* metrics can be manipulated externally by spoofing the HTTP Host header, which can lead to similar cardinality problems and degraded observability as open-telemetry/opentelemetry-specification#3470 (http.request.method).

After discussing with @lmolkova, our recommendation is make server.address and server.port Opt-In on all http.server.* metrics.

We believe that the majority of instrumented apps do not expose multiple virtual hosts/ports, and that the service.name resource attribute is a reasonable alternative to server.address and server.port in these cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Development

Successfully merging a pull request may close this issue.

2 participants