Structuring Data

For better data scrubbing on the server side, SDKs should save data in a structured way, when possible. Starting point of the discussion was RFC-0038

See also: Data Scrubbing for general sensitive data handling requirements.

Spans

This helps Relay to know what kind of data it receives and this helps with scrubbing sensitive data.

• http spans containing urls:

  The description of spans with op set to http must follow the format HTTP_METHOD scheme://host/path (ex. GET https://example.com/foo). If an authority is present in the URL (https://username:password@example.com), the authority must be replaced with a placeholder regardless of sendDefaultPii, leading to a new URL of https://[Filtered]:[Filtered]@example.com. If query strings are present in the URL or fragments (Browser SDKs only) are present in the URI, both are set into the data attribute of the span.

  JsPython

  Copied

  span.setAttributes({
    "http.query": url.getQuery(),
    "http.fragment": uri.getFragment(),
  });
  

  Additionally all semantic conventions of OpenTelemetry for http spans should be set in the span.data if applicable: https://opentelemetry.io/docs/reference/specification/trace/semantic_conventions/http/

• db spans containing database queries: (sql, graphql, elasticsearch, mongodb, ...)

  The description of spans with op set to db must not include any query parameters. Instead, use placeholders like SELECT FROM 'users' WHERE id = ?

Additionally all semantic conventions of OpenTelemetry for database spans should be set in the span.data if applicable: https://opentelemetry.io/docs/reference/specification/trace/semantic_conventions/database/