You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Sensitive values bypass the denylist in header and cookie collection #24085
A cookie header that cannot be split into name=value pairs ends up verbatim in an attribute key, and headers listed in headersToSpanAttributes skip the denylist, so an authorization header is sent in the clear.
Activity
linear-code commentedon Sep 4, 2026
JS-3592
s1gr1d commentedon Sep 17, 2026
Related changes:
fix(core): Apply the sensitive denylist to cookie headers and configu…
github-actions commentedon Sep 23, 2026
A PR closing this issue has just been released 🚀
This issue was referenced by PR #24090, which was included in the 11.0.0 release.