Scrub sensitive query param values from Replay URLs

[cielt]

Problem Statement

When Replays are captured and associated with a navigation event (by URL), we see in some cases that sensitive query param values (e.g., jwt or auth token) are displayed in full – either in a list view, ordered by URL, or on mouseover of some detail in a list of breadcrumbs.

In the sentry.client.config.js for our frontend (React - Next.js) app, we currently use the beforeBreadcrumb and beforeSend hooks to scrub sensitive values (including instances of a jwt param in URLs sent as part of a navigation or request breadcrumb, or in a stack trace). Is it possible to offer something like these hooks for Replays? Or some kind of config in the privacy & security settings that would address this?

Please let me know if more info / context would be helpful; happy to supply what i can. Thanks very much!

---

Please see the attachments below for details:

1️⃣ Entire jwt param visible on mouseover of URL in breadcrumb

2️⃣ Example of jwt param obfuscated with beforeBreadcrumb or beforeSend

3️⃣ Screen recording showing jwt revealed in full on mouseover
https://github.com/getsentry/sentry/assets/3287153/3f405d17-51b5-495e-8c86-6191d80db9e3

Solution Brainstorm

No response

Product Area

Replays

[getsantry]

Assigning to @getsentry/support for routing, due by Monday, May 22nd at 12:13 pm (sfo). ⏲️

[getsantry]

Routing to @getsentry/product-owners-replays for triage, due by Tuesday, May 23rd at 15:54 (yyz). ⏲️

[cmanallen]

Hey @cielt there's a PR here for tracking: getsentry/relay#2143

This will use platform and user-defined regexes to scrub PII.

[cielt]

Super; thanks @cmanallen!