From f10a747f36dd40e75e0302e51a0e8b299f1a8c7f Mon Sep 17 00:00:00 2001 From: ryder777777 Date: Thu, 22 Oct 2026 13:28:08 +0000 Subject: [PATCH 1/2] fix(wsgi): Redact CF-Connecting-IP, True-Client-IP, Forwarded, and X-Client-IP by default --- sentry_sdk/integrations/_wsgi_common.py | 5 ++++- tests/integrations/wsgi/test_wsgi.py | 25 ++++++++++++++++++------- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/sentry_sdk/integrations/_wsgi_common.py b/sentry_sdk/integrations/_wsgi_common.py index 3ccf029964..b14a431a52 100644 --- a/sentry_sdk/integrations/_wsgi_common.py +++ b/sentry_sdk/integrations/_wsgi_common.py @@ -31,8 +31,11 @@ "HTTP_AUTHORIZATION", "HTTP_PROXY_AUTHORIZATION", "HTTP_X_API_KEY", - "HTTP_X_FORWARDED_FOR", "HTTP_X_REAL_IP", + "HTTP_CF_CONNECTING_IP", + "HTTP_TRUE_CLIENT_IP", + "HTTP_FORWARDED", + "HTTP_X_CLIENT_IP", ) SENSITIVE_HEADERS = tuple( diff --git a/tests/integrations/wsgi/test_wsgi.py b/tests/integrations/wsgi/test_wsgi.py index 2cda3a1b98..b2858522ca 100644 --- a/tests/integrations/wsgi/test_wsgi.py +++ b/tests/integrations/wsgi/test_wsgi.py @@ -890,20 +890,31 @@ def test_request_headers_legacy_no_pii_redacts_sensitive( "/", headers={ "X-Forwarded-For": "1.2.3.4", + "X-Real-IP": "1.2.3.5", + "CF-Connecting-IP": "1.2.3.6", + "True-Client-IP": "1.2.3.7", + "Forwarded": "for=1.2.3.8", + "X-Client-IP": "1.2.3.9", "X-Custom-Header": "passthrough", }, ) (event,) = events - assert event["request"]["headers"]["X-Forwarded-For"] == "" - assert event["request"]["headers"]["X-Custom-Header"] == "passthrough" + for header in ( + "X-Forwarded-For", + "X-Real-IP", + "CF-Connecting-IP", + "True-Client-IP", + "Forwarded", + "X-Client-IP", + ): + assert event["request"]["headers"][header] == "" + assert event["_meta"]["request"]["headers"][header] == { + "": {"rem": [["!config", "x"]]} + } - # The emptied value is accompanied by a `_meta` annotation marking it as - # removed, confirming the substitution came from the AnnotatedValue path. - assert event["_meta"]["request"]["headers"]["X-Forwarded-For"] == { - "": {"rem": [["!config", "x"]]} - } + assert event["request"]["headers"]["X-Custom-Header"] == "passthrough" def test_request_headers_data_collection_off_collects_no_headers( From 91a837e7d7337fb7b33f88d6329a5bdf199dc123 Mon Sep 17 00:00:00 2001 From: ryder777777 Date: Thu, 22 Oct 2026 13:28:26 +0000 Subject: [PATCH 2/2] test(wsgi): Match title-cased WSGI header names in test_wsgi --- tests/integrations/wsgi/test_wsgi.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/integrations/wsgi/test_wsgi.py b/tests/integrations/wsgi/test_wsgi.py index b2858522ca..8f1237ca56 100644 --- a/tests/integrations/wsgi/test_wsgi.py +++ b/tests/integrations/wsgi/test_wsgi.py @@ -903,11 +903,11 @@ def test_request_headers_legacy_no_pii_redacts_sensitive( for header in ( "X-Forwarded-For", - "X-Real-IP", - "CF-Connecting-IP", - "True-Client-IP", + "X-Real-Ip", + "Cf-Connecting-Ip", + "True-Client-Ip", "Forwarded", - "X-Client-IP", + "X-Client-Ip", ): assert event["request"]["headers"][header] == "" assert event["_meta"]["request"]["headers"][header] == {