feat(http): [Data Collection 13] Apply cookie collection policy by adinauer · Pull Request #5811 · getsentry/sentry-java

adinauer · 2026-07-22T07:01:01Z

PR Stack (Data Collection)

📜 Description

Apply the cookie Data Collection policy to automatically captured request and response cookies.

The policy is used by Spring MVC/WebFlux, OkHttp, Ktor, and Apollo 3/4 failed-request events. Explicit Data Collection supports off, deny-list, and allow-list behavior. Built-in sensitive cookie names and Spring integration-provided session cookie names are always filtered, including when allow-listed. Set-Cookie values are parsed separately so attributes such as Path, HttpOnly, and SameSite are preserved.

When Data Collection is absent, integrations preserve their existing sendDefaultPii behavior, including Spring's legacy security-cookie filtering and raw HTTP-client cookie values.

💡 Motivation and Context

Cookie collection previously relied on sendDefaultPii as an on/off gate, with filtering only in Spring integrations. This wires the existing dataCollection.cookies option across cookie capture paths and provides consistent explicit-mode filtering without changing the legacy bridge for applications that have not configured Data Collection.

Refs #5666

💚 How did you test it?

./gradlew spotlessApply apiDump
./gradlew :sentry:apiCheck
Core cookie filtering tests
OkHttp and Ktor failed-request tests
Spring, Spring Jakarta, and Spring 7 request tests
Apollo 3 and Apollo 4 test suites
git diff --check

📝 Checklist

I added GH Issue ID & Linear ID
I added tests to verify the changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed.
I updated the wizard if needed.
Review from the native team if needed.
No breaking change or entry added to the changelog.
No breaking change for hybrid SDKs or communicated to hybrid SDKs.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Complete the remaining Data Collection configuration, documentation, and migration work.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

Filter automatically captured request and response cookies according to the Data Collection policy across Spring and HTTP client integrations. Preserve existing sendDefaultPii behavior when Data Collection is absent. Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2026-07-22T07:01:50Z

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 2434ba0

sentry · 2026-07-22T07:05:38Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.55.0 (1)	release

⚙️ sentry-android Build Distribution Settings

github-actions · 2026-07-22T07:09:09Z

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	387.14 ms	447.16 ms	60.02 ms
Size	0 B	0 B	0 B

Baseline results on branch: feat/data-collection-query-params

Startup times

Revision	Plain	With Sentry	Diff
`adae5de`	372.16 ms	476.20 ms	104.04 ms

App size

Revision	Plain	With Sentry	Diff
`adae5de`	0 B	0 B	0 B

Previous results on branch: feat/data-collection-cookies

Startup times

Revision	Plain	With Sentry	Diff
`670b3d8`	329.76 ms	371.15 ms	41.39 ms
`df76abc`	308.28 ms	356.24 ms	47.96 ms
`b0be236`	316.30 ms	372.60 ms	56.30 ms

App size

Revision	Plain	With Sentry	Diff
`670b3d8`	0 B	0 B	0 B
`df76abc`	0 B	0 B	0 B
`b0be236`	0 B	0 B	0 B

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

…ction-cookies

github-actions · 2026-08-10T12:42:30Z

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

This PR will not appear in the changelog.

_{🤖 This preview updates automatically when you update the PR.}

…ction-cookies

Validate cookie names and values before applying Data Collection filters. Fail closed for malformed values that could embed additional sensitive cookie pairs while preserving valid quoted and padded values. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode

added some comments!

Avoid adding nullable filter results to cookie header lists so downstream consumers only receive actual header values. Co-Authored-By: Claude <noreply@anthropic.com>

Keep empty and whitespace-only cookie segments unchanged instead of replacing them with a filtered marker. Co-Authored-By: Claude <noreply@anthropic.com>

Let unexpected implementation errors remain visible instead of swallowing fatal JVM errors during deterministic cookie parsing. Co-Authored-By: Claude <noreply@anthropic.com>

Move cookie parsing and filtering into a focused internal utility and update integrations to use it. Keep generic query and header filtering in HttpUtils. Co-Authored-By: Claude <noreply@anthropic.com>

Merge the latest main and landed Data Collection changes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

Exercise response cookie filtering with a valid cookie and preserve its attributes in the expected output. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode · 2026-09-07T15:14:34Z

+      final @Nullable Enumeration<String> headers,
+      final @Nullable String headerName,
+      final @Nullable List<String> additionalCookieNamesToFilter) {
+    if (headers == null) {


This is redundant since the next line does the same thing.

Collections.list(null) would throw a NPE so this is needed.

runningcode · 2026-09-07T15:26:57Z

    scopes.captureEvent(event, hint)
  }

+  private fun getRequestCookies(scopes: IScopes, cookies: String?): String? =


All of the getRequestCookies and getResponseCookies are copy pasted. Can we move them in to the Cookies.java class to reduce the copy/paste?

runningcode

pre-emptively giving a ✅ let me know if you'd like another review.

Bring the latest base branch fixes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

Move Data Collection and legacy cookie policy selection into CookieUtils. Remove duplicated wrappers from OkHttp, Ktor, and Apollo integrations. Co-Authored-By: Claude <noreply@anthropic.com>

This was referenced Jul 22, 2026

feat(core): Data Collection #5759

Draft

feat(core): [Data Collection 1] Add configuration types #5760

Merged

feat(core): [Data Collection 2] Expose SentryOptions API #5761

Merged

adinauer mentioned this pull request Jul 22, 2026

feat(user): [Data Collection 14] Apply user information policy #5812

Merged

9 tasks

adinauer and others added 2 commits July 23, 2026 10:30

fix(core): Filter malformed cookie pairs

1987b1e

Replace malformed request cookie pairs and invalid Set-Cookie values with the filtered placeholder. Preserve valid empty values, padded values, and response cookie attributes. Co-Authored-By: Claude <noreply@anthropic.com>

test(okhttp): Return headers from response mocks

9da9baa

Keep mocked OkHttp responses consistent with the non-null headers contract so failed-request capture can inspect response cookies. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

ccfe195

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

d7a900d

…ction-cookies

adinauer mentioned this pull request Aug 12, 2026

fix(android): [Data Collection 19] Preserve installation ID #5937

Merged

9 tasks

This was referenced Aug 24, 2026

Capture all repeated Cookie and Set-Cookie header values #5982

Open

fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983

Merged

adinauer added 3 commits August 27, 2026 14:53

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

c4e29eb

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

b9eeeb5

…ction-cookies

Merge branch 'feat/data-collection-query-params' into feat/data-colle…

71619ec

…ction-cookies

adinauer mentioned this pull request Sep 1, 2026

feat(core): [Data Collection 21] Add external configuration #6036

Merged

8 tasks

lbloder reviewed Sep 1, 2026

View reviewed changes

Comment thread sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientUtils.kt Outdated

lbloder reviewed Sep 1, 2026

View reviewed changes

Comment thread sentry/src/main/java/io/sentry/util/HttpUtils.java Outdated

adinauer mentioned this pull request Sep 2, 2026

feat(android): [Data Collection 22] Add manifest configuration #6038

Merged

8 tasks

Base automatically changed from feat/data-collection-query-params to feat/data-collection September 2, 2026 12:24

chore: Merge data collection base into cookie filtering

6cdd40e

Bring the latest data collection behavior into the cookie filtering branch and retain coverage for both cookie and request header filtering. Co-Authored-By: Claude <noreply@anthropic.com>

runningcode reviewed Sep 2, 2026

View reviewed changes

adinauer and others added 5 commits September 7, 2026 07:07

fix(core): Skip null filtered cookie headers

489982d

Avoid adding nullable filter results to cookie header lists so downstream consumers only receive actual header values. Co-Authored-By: Claude <noreply@anthropic.com>

fix(core): Preserve blank cookie segments

6900fba

Keep empty and whitespace-only cookie segments unchanged instead of replacing them with a filtered marker. Co-Authored-By: Claude <noreply@anthropic.com>

ref(core): Remove broad cookie filtering catches

3315b18

Let unexpected implementation errors remain visible instead of swallowing fatal JVM errors during deterministic cookie parsing. Co-Authored-By: Claude <noreply@anthropic.com>

ref(core): Extract cookie utilities from HTTP utilities

b11dcdd

Move cookie parsing and filtering into a focused internal utility and update integrations to use it. Keep generic query and header filtering in HttpUtils. Co-Authored-By: Claude <noreply@anthropic.com>

chore: Merge Data Collection branch updates

6a03c1f

Merge the latest main and landed Data Collection changes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

adinauer mentioned this pull request Sep 7, 2026

fix(core): [Data Collection 23] Support WebSocket URL parsing #6064

Merged

9 tasks

test(okhttp): Use valid Set-Cookie fixture

33078e4

Exercise response cookie filtering with a valid cookie and preserve its attributes in the expected output. Co-Authored-By: Claude <noreply@anthropic.com>

adinauer mentioned this pull request Sep 7, 2026

fix(core): [Data Collection 24] Narrow utility exception handling #6065

Merged

9 tasks

runningcode reviewed Sep 7, 2026

View reviewed changes

runningcode approved these changes Sep 7, 2026

View reviewed changes

adinauer and others added 2 commits September 8, 2026 08:03

chore: Merge Data Collection stack updates

069d598

Bring the latest base branch fixes into the cookie policy branch. Co-Authored-By: Claude <noreply@anthropic.com>

ref(core): Centralize HTTP client cookie filtering

2434ba0

Move Data Collection and legacy cookie policy selection into CookieUtils. Remove duplicated wrappers from OkHttp, Ktor, and Apollo integrations. Co-Authored-By: Claude <noreply@anthropic.com>

adinauer marked this pull request as ready for review September 8, 2026 09:22

adinauer requested review from 0xadam-brown, markushi and romtsn as code owners September 8, 2026 09:22

adinauer merged commit bb73d62 into feat/data-collection Sep 8, 2026
64 checks passed

adinauer deleted the feat/data-collection-cookies branch September 8, 2026 09:22

Uh oh!

Uh oh!

Conversation

adinauer commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Stack (Data Collection)

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sentry Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance metrics 🚀

Baseline results on branch: feat/data-collection-query-params

Startup times

App size

Previous results on branch: feat/data-collection-cookies

Startup times

App size

Uh oh!

github-actions Bot commented Aug 10, 2026

Semver Impact of This PR

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

runningcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

runningcode Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

adinauer Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

runningcode Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

runningcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adinauer commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading

sentry Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading