Sensitive query parameters leak to Sentry in event Referer HTTP header #25303

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

11.7.0

Framework Version

No response

Link to Sentry event

No response

Reproduction Example/SDK Setup

I set dataCollection.userInfo to false and otherwise didn't configure dataCollection.

Steps to Reproduce

I submitted a form on a page with a sensitive query parameter in the URL, such as ?jwt=baz. This resulted in the document having a Referer with the sensitive query parameter. I triggered a JS exception and looked at the event payload. The Referer is automatically captured in the event under request.headers.

Expected Result

Ideally, the Referer would be processed as a URL, and sensitive query params could be filtered?

Actual Result

The Referer header has the unfiltered URL.

Additional Context

This is a followup on #25247

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}