[Akshaay1]

Description

opentelemetry.util.http.PARAMS_TO_REDACT only covered AWSAccessKeyId, Signature, sig, and X-Goog-Signature. The semantic conventions url attribute registry also lists X-Amz-Signature, X-Amz-Credential, and X-Amz-Security-Token as query parameters that SHOULD be redacted by default.

Because those three keys were missing, an S3 SigV4 presigned URL fetched through an instrumented HTTP client (e.g. httpx, requests) exported its signature, credential scope, and — for temporary credentials — the full STS session token verbatim in the url.full/http.url span attribute.

This adds the three missing keys to PARAMS_TO_REDACT in opentelemetry-util-http, which is shared by the instrumentations that redact query parameters before setting URL attributes on spans.

Fixes #5279

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

See contributing.md for styleguide, changelog guidelines, and more.

• I am a human and not a bot
• I have run tox -e precommit
• I have run tox -e typecheck
• I have run the relevant tests and linting tox environments
• This requires the following PR in core:

Testing

• Added 4 regression tests to test_redact_query_parameters.py covering X-Amz-Signature, X-Amz-Credential, X-Amz-Security-Token, and a full SigV4 presigned-URL case. Confirmed via git stash that all 4 fail on unmodified main (the values pass through unredacted) and pass with the fix.
• pytest util/opentelemetry-util-http/tests/ (excluding two unrelated files that fail to collect in this sandbox due to missing opentelemetry-test-utils/wrapt dev dependencies, unrelated to this change): 61 passed, 13 subtests passed.
• ruff check / ruff format --check on both changed files: clean.
• Did not run the tox -e precommit / tox -e typecheck environments themselves (project-wide tox/mypy setup wasn't fully reproducible in this sandbox); ran the equivalent ruff checks directly instead.

This PR was prepared with AI assistance (see Assisted-by: commit trailer), and I've reviewed and tested the change above.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on maintainers · refreshed 2026-11-10 17:52 UTC

Merge when ready.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[preetsaini2004]

Hi @Akshaay1, thanks for picking this up. I reported this in #5279, including the repro and test values your tests use, and I'd ticked that I wanted to implement the fix myself. It would have been nice to get a heads-up on the issue first.

I'm happy for this PR to go ahead rather than open a competing one. Could you add me as a co-author on the commit, since the reproduction, test URLs and proposed fix come from the issue?

Co-authored-by: preetsaini2004 <91930460+preetsaini2004@users.noreply.github.com>

Thanks!

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Akshaay1 / name: Akshaay (2ca7de8, 36017e6, 42e666f)
• ✅ login: lzchen / name: Leighton Chen (17b1128)
• ✅ login: preetsaini2004 / name: Preet Saini (36017e6)
• ✅ login: xrmx / name: Riccardo Magliocchetti (11d3f5c, 4e669dc)

[Akshaay1]

Hi @preetsaini2004, you're right, I should have checked on the issue before opening this, sorry about that. Thanks for the detailed repro. I've added you as a co-author in 36017e6. EasyCLA now needs your signature before this can merge, so could you sign using the link in the bot's comment above?