Skip to content

Mask filterable parameters from sanitised URLs

Andrew Newdigate requested to merge an-sanitize-url-parameters into master

What does this MR do?

Sanitised URLS are used for logging and display purposes only, and are intended to prevent sensitive information, such as credentials and access tokens.

This change ensures that if URLs contain certain parameters, as configured by Rails.application.config.filter_parameters, these parameters in the sanitised URL will be masked with the phrase [FILTERED].

This is required for distributed tracing, which emits the http.url field, which is intended to include the full URL including querystring parameters. Since we want to avoid sensitive information was as ?private_token values leaking, we need to mask the URL

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Edited by Andrew Newdigate

Merge request reports