feat(http): [Data Collection 13] Apply cookie collection policy by adinauer · Pull Request #5811 · getsentry/sentry-java

adinauer · 2026-07-22T07:01:01Z

PR Stack (Data Collection)

📜 Description

Apply the cookie Data Collection policy to automatically captured request and response cookies.

The policy is used by Spring MVC/WebFlux, OkHttp, Ktor, and Apollo 3/4 failed-request events. Explicit Data Collection supports off, deny-list, and allow-list behavior. Built-in sensitive cookie names and Spring integration-provided session cookie names are always filtered, including when allow-listed. Set-Cookie values are parsed separately so attributes such as Path, HttpOnly, and SameSite are preserved.

When Data Collection is absent, integrations preserve their existing sendDefaultPii behavior, including Spring's legacy security-cookie filtering and raw HTTP-client cookie values.

💡 Motivation and Context

Cookie collection previously relied on sendDefaultPii as an on/off gate, with filtering only in Spring integrations. This wires the existing dataCollection.cookies option across cookie capture paths and provides consistent explicit-mode filtering without changing the legacy bridge for applications that have not configured Data Collection.

Refs #5666

💚 How did you test it?

./gradlew spotlessApply apiDump
./gradlew :sentry:apiCheck
Core cookie filtering tests
OkHttp and Ktor failed-request tests
Spring, Spring Jakarta, and Spring 7 request tests
Apollo 3 and Apollo 4 test suites
git diff --check

📝 Checklist

I added GH Issue ID & Linear ID
I added tests to verify the changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed.
I updated the wizard if needed.
Review from the native team if needed.
No breaking change or entry added to the changelog.
No breaking change for hybrid SDKs or communicated to hybrid SDKs.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Complete the remaining Data Collection configuration, documentation, and migration work.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

Filter automatically captured request and response cookies according to the Data Collection policy across Spring and HTTP client integrations. Preserve existing sendDefaultPii behavior when Data Collection is absent. Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2026-07-22T07:01:50Z

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 6cdd40e

sentry · 2026-07-22T07:05:38Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.48.0 (1)	release

⚙️ sentry-android Build Distribution Settings

github-actions · 2026-07-22T07:09:09Z

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	387.14 ms	447.16 ms	60.02 ms
Size	0 B	0 B	0 B

Baseline results on branch: feat/data-collection-query-params

Startup times

Revision	Plain	With Sentry	Diff
`adae5de`	372.16 ms	476.20 ms	104.04 ms

App size

Revision	Plain	With Sentry	Diff
`adae5de`	0 B	0 B	0 B

Previous results on branch: feat/data-collection-cookies

Startup times

Revision	Plain	With Sentry	Diff
`670b3d8`	329.76 ms	371.15 ms	41.39 ms
`df76abc`	308.28 ms	356.24 ms	47.96 ms
`b0be236`	316.30 ms	372.60 ms	56.30 ms

App size

Revision	Plain	With Sentry	Diff
`670b3d8`	0 B	0 B	0 B
`df76abc`	0 B	0 B	0 B
`b0be236`	0 B	0 B	0 B

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

…ction-cookies

github-actions · 2026-08-10T12:42:30Z

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

This PR will not appear in the changelog.

_{🤖 This preview updates automatically when you update the PR.}

…ction-cookies

lbloder · 2026-09-01T15:29:41Z

-        // Cookie is only sent if isSendDefaultPii is enabled
        urlDetails.applyToRequest(this)
-        cookies = if (scopes.options.isSendDefaultPii) request.headers["Cookie"] else null
+        cookies = getRequestCookies(scopes, request.headers["Cookie"])


There could be multiple Cookie and Set-Cookie headers. we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

I've created #5982 so we can change this (likely) in the next major.

lbloder · 2026-09-01T15:29:58Z

      io.sentry.protocol.Response().apply {
-        // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
-        cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
+        cookies = getResponseCookies(scopes, response.headers["Set-Cookie"])


There could be multiple Cookie and Set-Cookie headers. we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

lbloder · 2026-09-01T15:30:22Z

        urlDetails.applyToRequest(this)
-        // Cookie is only sent if isSendDefaultPii is enabled
-        cookies = if (scopes.options.isSendDefaultPii) request.headers["Cookie"] else null
+        cookies = getRequestCookies(scopes, request.headers["Cookie"])


There could be multiple Cookie and Set-Cookie headers. here we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

lbloder · 2026-09-01T15:30:26Z

      io.sentry.protocol.Response().apply {
-        // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
-        cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
+        cookies = getResponseCookies(scopes, response.headers["Set-Cookie"])


There could be multiple Cookie and Set-Cookie headers. here we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

lbloder · 2026-09-01T15:31:34Z

+  }
+
+  private fun getResponseCookies(headers: List<HttpHeader>): String? {
+    val cookies = getHeader("Set-Cookie", headers)


There could be multiple Cookie and Set-Cookie headers. here we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

lbloder · 2026-09-01T15:31:41Z

-            } else {
-              null
-            }
+          cookies = getResponseCookies(response.headers)


There could be multiple Cookie and Set-Cookie headers. here we are currently only ever processing one of them and send them to sentry. Is that what we want or should we go through all of these?

lbloder · 2026-09-01T18:36:41Z

+    }
+
+    try {
+      final @NotNull String[] cookieValues = cookies.split(";", -1);


Malformed cookies could become a problem. i.e.

Cookie: theme=dark, sessionId=secret Cookie: theme=dark sessionId=secret

would be parsed as valid in our current implementation and leak the sessionId.
This is a fabricated example but we may want to check for cookie validity

I've improved the parser so this now falls back to [Filtered].

Validate cookie names and values before applying Data Collection filters. Fail closed for malformed values that could embed additional sensitive cookie pairs while preserving valid quoted and padded values. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode

added some comments!

runningcode · 2026-09-02T14:37:48Z

+            filterCookie(cookieValues[i], behavior, additionalSensitiveCookieNames));
+      }
+      return filteredCookies.toString();
+    } catch (Throwable ignored) {


This should probably catch something narrower otherwise we have no way of knowing that this code is working or not.
We also shouldn't be catching exceptions like OutOfMemoryError or StackOverflowError as the jvm is already in a bad state and ignoring it will leave the JVM in a worse state.

runningcode · 2026-09-02T14:38:57Z

    return filteredQuery.toString();
  }

+  public static @Nullable List<String> filterCookiesFromHeader(


Two nits:

Can we move all the cookie related methods to a Cookies.java? I feel HttpUtils.java is getting too long. This also makes the methods more idiomatic. Cookies.filterFromHeader() reads more naturally to me than HttpUtils.filterCookiesFromHeader()

Can we declare all of these as @ApiUsage.Internal or are they intended to be customer facing?

runningcode · 2026-09-02T14:47:54Z

+    return filteredHeaders;
+  }
+
+  public static @Nullable String filterCookies(


can you add a test for trailing spaces in cookies ?
my clanker tells me this would add a [Filtered] because of the way split is called.

runningcode · 2026-09-02T14:48:26Z

+
+    final @NotNull List<String> filteredHeaders = new ArrayList<>();
+    for (final String header : headers) {
+      filteredHeaders.add(filterCookies(header, behavior, additionalSensitiveCookieNames));


this can add null items in to the list since filterCookies is @Nullable

This was referenced Jul 22, 2026

feat(core): Data Collection #5759

Draft

feat(core): [Data Collection 1] Add configuration types #5760

Merged

feat(core): [Data Collection 2] Expose SentryOptions API #5761

Merged

adinauer mentioned this pull request Jul 22, 2026

feat(user): [Data Collection 14] Apply user information policy #5812

Draft

9 tasks

adinauer and others added 2 commits July 23, 2026 10:30

fix(core): Filter malformed cookie pairs

1987b1e

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

test(okhttp): Return headers from response mocks

9da9baa

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

ccfe195

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

d7a900d

…ction-cookies

adinauer mentioned this pull request Aug 12, 2026

fix(android): [Data Collection 19] Preserve installation ID #5937

Draft

9 tasks

This was referenced Aug 24, 2026

Capture all repeated Cookie and Set-Cookie header values #5982

Open

fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983

Draft

merge: Update Data Collection stack

501c268

adinauer mentioned this pull request Aug 25, 2026

fix(opentelemetry): [Data Collection 21] Exclude queries from span descriptions #5985

Draft

9 tasks

adinauer added 4 commits August 27, 2026 14:51

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

988579b

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

c4e29eb

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

b9eeeb5

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

71619ec

…ction-cookies

adinauer mentioned this pull request Sep 1, 2026

feat(core): [Data Collection 22] Add external configuration #6036

Draft

8 tasks

lbloder reviewed Sep 1, 2026

View reviewed changes

adinauer mentioned this pull request Sep 2, 2026

feat(android): [Data Collection 23] Add manifest configuration #6038

Draft

8 tasks

Base automatically changed from feat/data-collection-query-params to feat/data-collection September 2, 2026 12:24

chore: Merge data collection base into cookie filtering

6cdd40e

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode reviewed Sep 2, 2026

View reviewed changes

Uh oh!

Uh oh!

Conversation

adinauer commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Stack (Data Collection)

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sentry Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance metrics 🚀

Baseline results on branch: feat/data-collection-query-params

Startup times

App size

Previous results on branch: feat/data-collection-cookies

Startup times

App size

Uh oh!

github-actions Bot commented Aug 10, 2026

Semver Impact of This PR

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

runningcode left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adinauer commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading

sentry Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading