feat(http): [Data Collection 13] Apply cookie collection policy

sentry-apollo-3/src/main/java/io/sentry/apollo3/SentryApollo3HttpInterceptor.kt

@@ -27,6 +27,7 @@ import io.sentry.exception.ExceptionMechanismException
 import io.sentry.protocol.Mechanism
 import io.sentry.protocol.Request
 import io.sentry.protocol.Response
+import io.sentry.util.CookieUtils
 import io.sentry.util.GraphqlUtils
 import io.sentry.util.HttpUtils
 import io.sentry.util.IntegrationUtils.addIntegrationToSdkVersion
@@ -391,9 +392,7 @@ constructor(
       val sentryRequest =
         Request().apply {
           urlDetails.applyToRequest(this)
-          // Cookie is only sent if isSendDefaultPii is enabled
-          cookies =
-            if (scopes.options.isSendDefaultPii) getHeader("Cookie", request.headers) else null
+          cookies = CookieUtils.filterCookies(getHeader("Cookie", request.headers), scopes.options)
           method = request.method.name
           headers = getRequestHeaders(request.headers)
           apiTarget = "graphql"
@@ -419,13 +418,8 @@ constructor(
 
       val sentryResponse =
         Response().apply {
-          // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
           cookies =
-            if (scopes.options.isSendDefaultPii) {
-              getHeader("Set-Cookie", response.headers)
-            } else {
-              null
-            }
+            CookieUtils.filterSetCookie(getHeader("Set-Cookie", response.headers), scopes.options)
           headers = getResponseHeaders(response.headers)
           statusCode = response.statusCode
 

sentry-apollo-3/src/test/java/io/sentry/apollo3/SentryApollo3InterceptorClientErrors.kt

@@ -73,6 +73,7 @@ class SentryApollo3InterceptorClientErrors {
       httpStatusCode: Int = 200,
       responseBody: String = responseBodyOk,
       sendDefaultPii: Boolean = false,
+      includeCookies: Boolean = sendDefaultPii,
       socketPolicy: SocketPolicy = SocketPolicy.KEEP_OPEN,
       configureOptions: SentryOptions.() -> Unit = {},
     ): ApolloClient {
@@ -98,8 +99,8 @@ class SentryApollo3InterceptorClientErrors {
           .setSocketPolicy(socketPolicy)
           .setResponseCode(httpStatusCode)
 
-      if (sendDefaultPii) {
-        response.addHeader("Set-Cookie", "Test")
+      if (includeCookies) {
+        response.addHeader("Set-Cookie", "theme=dark; Path=/")
       }
 
       server.enqueue(response)
@@ -112,8 +113,8 @@ class SentryApollo3InterceptorClientErrors {
             captureFailedRequests = captureFailedRequests,
             failedRequestTargets = failedRequestTargets,
           )
-      if (sendDefaultPii) {
-        builder.addHttpHeader("Cookie", "Test")
+      if (includeCookies) {
+        builder.addHttpHeader("Cookie", "theme=dark; sessionId=secret")
       }
 
       return builder.build()
@@ -362,6 +363,46 @@ class SentryApollo3InterceptorClientErrors {
       )
   }
 
+  @Test
+  fun `data collection filters cookies`() {
+    val sut =
+      fixture.getSut(responseBody = fixture.responseBodyNotOk, includeCookies = true) {
+        dataCollection.cookies = KeyValueCollectionBehavior.denyList("theme")
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertEquals("theme=[Filtered]; sessionId=[Filtered]", it.request!!.cookies)
+          assertEquals("theme=[Filtered]; Path=/", it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable cookies`() {
+    val sut =
+      fixture.getSut(
+        responseBody = fixture.responseBodyNotOk,
+        sendDefaultPii = true,
+        includeCookies = true,
+      ) {
+        dataCollection.cookies = KeyValueCollectionBehavior.off()
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertNull(it.request!!.cookies)
+          assertNull(it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `data collection can disable request headers`() {
     val sut =
@@ -387,7 +428,7 @@ class SentryApollo3InterceptorClientErrors {
         check {
           val request = it.request!!
 
-          assertEquals("Test", request.cookies)
+          assertEquals("theme=dark; sessionId=secret", request.cookies)
           assertNotNull(request.headers)
           assertEquals("LaunchDetails", request.headers?.get("X-APOLLO-OPERATION-NAME"))
         },
@@ -477,7 +518,7 @@ class SentryApollo3InterceptorClientErrors {
         check {
           val response = it.contexts.response!!
 
-          assertEquals("Test", response.cookies)
+          assertEquals("theme=dark; Path=/", response.cookies)
           assertNotNull(response.headers)
           assertEquals(200, response.headers?.get("Content-Length")?.toInt())
         },

sentry-apollo-4/src/main/java/io/sentry/apollo4/SentryApollo4HttpInterceptor.kt

@@ -25,6 +25,7 @@ import io.sentry.exception.ExceptionMechanismException
 import io.sentry.protocol.Mechanism
 import io.sentry.protocol.Request
 import io.sentry.protocol.Response
+import io.sentry.util.CookieUtils
 import io.sentry.util.GraphqlUtils
 import io.sentry.util.HttpUtils
 import io.sentry.util.IntegrationUtils.addIntegrationToSdkVersion
@@ -390,9 +391,7 @@ constructor(
       val sentryRequest =
         Request().apply {
           urlDetails.applyToRequest(this)
-          // Cookie is only sent if isSendDefaultPii is enabled
-          cookies =
-            if (scopes.options.isSendDefaultPii) getHeader("Cookie", request.headers) else null
+          cookies = CookieUtils.filterCookies(getHeader("Cookie", request.headers), scopes.options)
           method = request.method.name
           headers = getRequestHeaders(request.headers)
           apiTarget = "graphql"
@@ -418,13 +417,8 @@ constructor(
 
       val sentryResponse =
         Response().apply {
-          // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
           cookies =
-            if (scopes.options.isSendDefaultPii) {
-              getHeader("Set-Cookie", response.headers)
-            } else {
-              null
-            }
+            CookieUtils.filterSetCookie(getHeader("Set-Cookie", response.headers), scopes.options)
           headers = getResponseHeaders(response.headers)
           statusCode = response.statusCode
 

sentry-apollo-4/src/test/java/io/sentry/apollo4/SentryApollo4BuilderExtensionsClientErrorsTest.kt

@@ -87,6 +87,7 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
       httpStatusCode: Int = 200,
       responseBody: String = responseBodyOk,
       sendDefaultPii: Boolean = false,
+      includeCookies: Boolean = sendDefaultPii,
       socketPolicy: SocketPolicy = SocketPolicy.KEEP_OPEN,
       configureOptions: SentryOptions.() -> Unit = {},
     ): ApolloClient {
@@ -112,8 +113,8 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
           .setSocketPolicy(socketPolicy)
           .setResponseCode(httpStatusCode)
 
-      if (sendDefaultPii) {
-        response.addHeader("Set-Cookie", "Test")
+      if (includeCookies) {
+        response.addHeader("Set-Cookie", "theme=dark; Path=/")
       }
 
       server.enqueue(response)
@@ -126,8 +127,8 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
             captureFailedRequests = captureFailedRequests,
             failedRequestTargets = failedRequestTargets,
           )
-      if (sendDefaultPii) {
-        builder.addHttpHeader("Cookie", "Test")
+      if (includeCookies) {
+        builder.addHttpHeader("Cookie", "theme=dark; sessionId=secret")
       }
 
       return builder.build()
@@ -356,6 +357,46 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
       )
   }
 
+  @Test
+  fun `data collection filters cookies`() {
+    val sut =
+      fixture.getSut(responseBody = fixture.responseBodyNotOk, includeCookies = true) {
+        dataCollection.cookies = KeyValueCollectionBehavior.denyList("theme")
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertEquals("theme=[Filtered]; sessionId=[Filtered]", it.request!!.cookies)
+          assertEquals("theme=[Filtered]; Path=/", it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable cookies`() {
+    val sut =
+      fixture.getSut(
+        responseBody = fixture.responseBodyNotOk,
+        sendDefaultPii = true,
+        includeCookies = true,
+      ) {
+        dataCollection.cookies = KeyValueCollectionBehavior.off()
+      }
+    executeQuery(sut)
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertNull(it.request!!.cookies)
+          assertNull(it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `data collection filters request headers`() {
     val sut =
@@ -398,7 +439,7 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
         check {
           val request = it.request!!
 
-          assertEquals("Test", request.cookies)
+          assertEquals("theme=dark; sessionId=secret", request.cookies)
           assertNotNull(request.headers)
         },
         any<Hint>(),
@@ -487,7 +528,7 @@ abstract class SentryApollo4BuilderExtensionsClientErrorsTest(
         check {
           val response = it.contexts.response!!
 
-          assertEquals("Test", response.cookies)
+          assertEquals("theme=dark; Path=/", response.cookies)
           assertNotNull(response.headers)
           assertEquals(200, response.headers?.get("Content-Length")?.toInt())
         },

sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientUtils.kt

@@ -16,6 +16,7 @@ import io.sentry.TypeCheckHint
 import io.sentry.exception.ExceptionMechanismException
 import io.sentry.exception.SentryHttpClientException
 import io.sentry.protocol.Mechanism
+import io.sentry.util.CookieUtils
 import io.sentry.util.HttpUtils
 import io.sentry.util.UrlUtils
 
@@ -36,18 +37,16 @@ internal object SentryKtorClientUtils {
 
     val sentryRequest =
       io.sentry.protocol.Request().apply {
-        // Cookie is only sent if isSendDefaultPii is enabled
         urlDetails.applyToRequest(this)
-        cookies = if (scopes.options.isSendDefaultPii) request.headers["Cookie"] else null
+        cookies = CookieUtils.filterCookies(request.headers["Cookie"], scopes.options)
         method = request.method.value
         headers = getRequestHeaders(scopes, request.headers)
         bodySize = request.content.contentLength
       }
 
     val sentryResponse =
       io.sentry.protocol.Response().apply {
-        // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
-        cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
+        cookies = CookieUtils.filterSetCookie(response.headers["Set-Cookie"], scopes.options)
         headers = getResponseHeaders(scopes, response.headers)
         statusCode = response.status.value
         try {

sentry-ktor-client/src/test/java/io/sentry/ktorClient/SentryKtorClientPluginTest.kt

@@ -104,6 +104,7 @@ class SentryKtorClientPluginTest {
         MockResponse()
           .setBody(responseBody)
           .addHeader("myResponseHeader", "myValue")
+          .addHeader("Set-Cookie", "theme=dark; Path=/")
           .setSocketPolicy(socketPolicy)
           .setResponseCode(httpStatusCode)
       )
@@ -256,6 +257,60 @@ class SentryKtorClientPluginTest {
     verify(fixture.scopes, never()).captureEvent(any(), any<Hint>())
   }
 
+  @Test
+  fun `data collection filters cookies`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        captureFailedRequests = true,
+        httpStatusCode = 500,
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.cookies = KeyValueCollectionBehavior.denyList("theme")
+          },
+      )
+
+    sut.get(fixture.server.url("/hello").toString()) {
+      headers["Cookie"] = "language=en; theme=dark; sessionId=secret"
+    }
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check<SentryEvent> {
+          assertEquals(
+            "language=en; theme=[Filtered]; sessionId=[Filtered]",
+            it.request!!.cookies,
+          )
+          assertEquals("theme=[Filtered]; Path=/", it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
+  @Test
+  fun `data collection can disable cookies`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        captureFailedRequests = true,
+        httpStatusCode = 500,
+        sendDefaultPii = true,
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.cookies = KeyValueCollectionBehavior.off()
+          },
+      )
+
+    sut.get(fixture.server.url("/hello").toString()) { headers["Cookie"] = "theme=dark" }
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check<SentryEvent> {
+          assertNull(it.request!!.cookies)
+          assertNull(it.contexts.response!!.cookies)
+        },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `data collection filters request headers`(): Unit = runBlocking {
     val sut =

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpUtils.kt

@@ -7,6 +7,7 @@ import io.sentry.TypeCheckHint
 import io.sentry.exception.ExceptionMechanismException
 import io.sentry.exception.SentryHttpClientException
 import io.sentry.protocol.Mechanism
+import io.sentry.util.CookieUtils
 import io.sentry.util.HttpUtils
 import io.sentry.util.UrlUtils
 import okhttp3.Headers
@@ -37,8 +38,7 @@ internal object SentryOkHttpUtils {
     val sentryRequest =
       io.sentry.protocol.Request().apply {
         urlDetails.applyToRequest(this)
-        // Cookie is only sent if isSendDefaultPii is enabled
-        cookies = if (scopes.options.isSendDefaultPii) request.headers["Cookie"] else null
+        cookies = CookieUtils.filterCookies(request.headers["Cookie"], scopes.options)
         method = request.method
         headers = getRequestHeaders(scopes, request.headers)
 
@@ -47,8 +47,7 @@ internal object SentryOkHttpUtils {
 
     val sentryResponse =
       io.sentry.protocol.Response().apply {
-        // Set-Cookie is only sent if isSendDefaultPii is enabled due to PII
-        cookies = if (scopes.options.isSendDefaultPii) response.headers["Set-Cookie"] else null
+        cookies = CookieUtils.filterSetCookie(response.headers["Set-Cookie"], scopes.options)
         headers = getResponseHeaders(scopes, response.headers)
         statusCode = response.code