Data scrubbing should filter sensitive headers such as Set-Cookie

[marandaneto]

OkHttp defines its own sensitive headers.
Some of them are filtered by Relay already, but not all of them.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cookie

Not all HTTP clients respect that Set-Cookie should not be accessible.

Cookie is just removed from the headers list instead of being [Filtered], most likely because there's a high-level property Request#cookies already.

[untitaker]

the request interface of an event is for http request headers, set-cookie is a response header. generally we are filtering header names iirc

[marandaneto]

We're trying to use the request property for all the merged headers (request, response), but since there's this limitation plus a few other ones, I will reconsider that.
I'll leave that up to you if you still wanna run scrubbing or not, there's also the inconsistency of Cookie being removed instead of filtered.

[jjbayer]

I suggest we put this hold until we've completed the RFC on where to put response data in the event payload.

[untitaker]

We're trying to use the request property for all the merged headers (request, response), but since there's this limitation plus a few other ones, I will reconsider that.

I would definitely not do that. Which RFC are we talking about?

[marandaneto]

@untitaker I'm going to write an RFC that adds Event.response or Event.contexts.response, data structure similar to event.request but with additional fields such as status_code, etc...
Data scrubbing would need to give a pass in the headers field, etc.

[untitaker]

@marandaneto sounds good. there is potential for a lot of pii there so i think we should think about designing new default scrubbing rules in the same vein.

[marandaneto]

@marandaneto sounds good. there is potential for a lot of pii there so i think we should think about designing new default scrubbing rules in the same vein.

getsentry/rfcs#22

[marandaneto]

Closing in favor of getsentry/rfcs#22
Request #headers[Cookie] is removed from the list because it's set to the high-level field cookies if found.
Set-Cookie isn't scrubbed because it's a response header and it should not be set in the first place.
Response headers go to the Response interface -> getsentry/rfcs#22