HTTP Span Attributes: http.url must not contain username / password

[matej-g]

As is stated in the recent specification change :

http.url MUST NOT contain credentials passed via URL in form of https://username:password@www.example.com/. In such case the attribute's value should be https://www.example.com/.

This should be reflected in HTTPClientAttributesFromHTTPRequest

[mrveera]

I understand this is coming from spec but for enduser it won't be evident that URL was containing username and password when it got here. Instead if we have redacted version like https://***:***@www.example.com/ it will be more evident in expressing URL contains username and password but they are redacted for security reasons.

If we don't go with redacted version it might cause ambiguity for someone checking if url contains creds or not because in span with creds and without creds will be same.

[matej-g]

If we don't go with redacted version it might cause ambiguity for someone checking if url contains creds or not because in span with creds and without creds will be same.

Yes, I think this could be a valid concern. However, it seems the specification suggests to drop everything (see the quoted excerpt in the issue description, also see the discussion). Maybe in such cases this could be alleviated in other way, perhaps adding an attribute, if desired?

[pellared]

For sake of transparency: open-telemetry/opentelemetry-specification#1502 (comment)