Query parameters in "http.url" tag

[pauqilaz]

The http.url span tag is currrently set to "$scheme://$http_host$request_uri" which includes the query parameters. Since these are more likely to contain sensitive information, would it make sense to remove the query parameters from the tag ?

Thanks!

[miry]

@pauqilaz You are right. I would advice to obfuscate/drop tag in opentelemetry collector side. Another suggestion to move sensitive information from query to headers, just because of this. The url is mostly likely be logged or shared in other places.

[pauqilaz]

Removing it altogether is one possibility, since it can still be re-added as an optional tag. Alternatively, replacing it with "$scheme://$http_host$uri" should already remove the query parameters.

[miry]

More about semantic convention of http.url in https://opentracing.io/specification/conventions/

http.url	string	URL of the request being handled in this segment of the trace, in standard URI format. E.g., "https://domain.net/path/to?resource=here"