remove sensitive data from ai.operation.name tag

[RemcoBlok]

When using oauth2 / openid connect a redirect takes place with an access token in the url fragment. This url including the access token in the url fragment appears in the ai.operation.name tag of telemetry. I would like to be able to remove the url fragment from the ai.operation.name tag using a telemetry initializer. However, when a telemetry initializer is called the ai.operation.name tag is not yet set, so I am unable to remove the url fragment from the tag. It appears the ai.operation.name tag is set after the telemetry initializer is called. Can this be changed please?

[MSNev]

Which version of the SDK are you using?

Looking through the code this is populated from the automatic values assigned to the context.telemetryTrace.name (in the latest Sdk) which is populated from the window.location.pathname, so assuming that the fragment (stuff after the '#') is being included in this for the browser then the option would be to either

• Change this value during page load / Sdk initialization to remove everything after the '#'
• Do the same in the telemetry initialzer (although you only need to do this once) -- but as it's a redirect scenario you probably won't be getting many events occurring -- this is of course that you have a specific page being returned / initialized for the redirect flow.

[RemcoBlok]

Thanks for your reply. We use version 2.8.1.

We managed to get the url fragment containing an access token removed from the ai.operation.name tag by removing it from envelope.baseData.name and envelope.baseData.target where envelope.baseType is RemoteDependencyData.

We also had to remove the url fragment containing an access token from envelope.baseData.uri and envelope.baseData.refUri where envelope.baseType is PageviewData and from envelope.baseData.uri where envelope.baseType is PageviewPerformanceData.

Finally we also had to remove it from envelope.ext.trace.name for all telemetry. This one made us wonder if this might break how application insights correlates telemetry, but it seems to still be ok.

[github-actions[bot]]

This Issue will be closed in 30 days. Please remove the "Stale" label or comment to avoid closure with no action.

[github-actions[bot]]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.