Set url.full attribute on spans logged for HTTP requests - #906
Conversation
|
Added the more scoped logging and configuration options to opt into full URL logging and to opt out to path logging. I chose to mark |
|
I think Almost any string field can, in theory, have PII, and I think this is the wrong place to try to make that call. Let application owners filter PII in their telemetry backends instead. |
Are you suggesting that we don’t have any configuration options for this in async-http-client? I personally don’t have an opinion either way. |
|
That's right. That's both how OpenTelemetry and the Swift observability libraries are designed. |
5cda988 to
7a0d2f2
Compare
|
Updated the PR to remove the configuration options. |
|
Just chiming in to say this looks good! Agree on not doing tens of settings in the lib itself, collectors can handle that 👍 |
|
@czechboy0 @FranzBusch could I get another review on this? |
|
Updated to only strip username and password. I would appreciate another review. |
ktoso
left a comment
There was a problem hiding this comment.
Looks good to me, we do our best but it’s collectors and vis config that may need to do more scrubbing anyway.
|
If you’re happy with this, could you merge the PR? I don’t have merge access to this repo. |
|
I'm going to wait for the other PR to be merged first as the failure was introduced by your code and we'd rather not merge new CI regressions. |
|
Agh, sorry @ahoppen -- I was wrong, that change didn't fix it. It's not obvious to me why your change fails to build for docs but does for "regular" CI runs. |
We previously only set the request method on these spans, which made it hard to identify which exact HTTP request was causing this span to be emitted. Also record the URL of the HTTP request to add more information to these spans. While at it, also record the request body size because we already had an attribute key configured for it.
|
Oh, interesting that this got caught as part of the doc check. I just didn’t check that code builds with |
Head branch was pushed to by a user without write access
…331) ## Summary - Adds `url.scheme`, `server.address`, `server.port`, `url.path`, and `http.request.body.size` to the request span `RawTask` starts, on top of the existing `http.request.method`/`url.full`. This mirrors what `async-http-client`'s own built-in tracing gained in [swift-server/async-http-client#906](swift-server/async-http-client#906) (released in 1.36.1) — previously it only set `http.request.method`. `url.query` is deliberately left out since query strings can carry tokens/PII that shouldn't land on a span by default. - Splits `RawTask._result(environment:)`, which had grown into one ~210-line function doing hook notification, executor/network-path validation, client resolution, and the whole span lifecycle, into focused private methods (`notifyDescriptorHooks`, `validateRequiredExecutor`, `waitForNetworkPath`, `resolveClient`, `runSession`, `executeTraced`, `startRequestSpan`, `setURLAttributes`, `endRequestSpan`). ## Why breaking-changes No public API changed — this is an internal refactor plus additive span attributes. Labeled `breaking-changes` per explicit request rather than an assessment that anything actually breaks for consumers. ## Design notes - The refactor preserves task-local propagation timing exactly: the code this file exists for (owning the span lifecycle itself so `ServiceContext.current` survives, instead of delegating to `async-http-client`'s tracing, which loses it on an `EventLoop` hop) is unaffected, since the extracted methods are still called synchronously within the same task — no new `Task`/`EventLoop` boundary was introduced. - `server.port` falls back to the scheme's default (80/443) when the URL has none, mirroring `async-http-client`'s `DeconstructedURL`/`Scheme.defaultPort`. ## Test plan - [x] `swift build` — clean build - [x] `swift test --filter "RequestServiceContextTests|SessionTests|RawTask"` — 50/50 passing - [x] `swift test --filter RequestDLTests` — full suite, 1123/1123 passing 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: brennobemoura <37243584+brennobemoura@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
We previously only set the request method on these spans, which made it hard to identify which exact HTTP request was causing this span to be emitted.
Also record the URL of the HTTP request to add more information to these spans. While at it, also record the request body size because we already had an attribute key configured for it.