Data Collected for Spring Boot
See what data is collected by the Sentry Java SDK.
Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.
The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. This page lists data categories that the Sentry Java SDK collects. Use dataCollectionto control automatic collection for supported categories.
After you configure any Data Collection field or call options.getDataCollection().forceDataCollection(), unconfigured fields use their documented defaults.
Data Collection controls only data added automatically by SDK integrations. Data you add through scopes, event processors, beforeSend, or other APIs is still sent.
Request and response headers use DENY_LIST by default. Supported integrations collect header names and non-sensitive values while replacing sensitive values with "[Filtered]".
Configure dataCollection.httpHeaders.request and dataCollection.httpHeaders.response to control header collection. Cookie and Set-Cookie values in the general HTTP header map are always replaced with "[Filtered]"; use dataCollection.cookies to control separately collected cookie data. Servlet and Spring integrations can collect incoming request headers. OkHttp, Ktor Client, and Apollo can attach request and response headers to captured HTTP client errors.
Cookies use DENY_LIST by default. Supported integrations collect cookies while replacing sensitive values with "[Filtered]". Use dataCollection.cookies to control cookie collection.
dataCollection.userInfo allows integrations to populate user identity information automatically, including Spring Security usernames and the user's IP address. It defaults to true. Set it to false to disable automatic user enrichment. User information you set explicitly with Sentry.setUser() or on a scope isn't removed.
When dataCollection.userInfo is true, the SDK adds "{{auto}}" as the user's IP address so Sentry can infer it from the connection. Set dataCollection.userInfo=false to disable automatic IP enrichment.
The request URL (without the query string) of outgoing and incoming HTTP requests is always sent to Sentry. Depending on your application, this could contain PII data.
Query parameters use DENY_LIST by default. Use dataCollection.urlQueryParams to filter or disable query string collection for instrumented incoming and outgoing URLs, including HTTP spans and breadcrumbs created by integrations such as Spring and OpenFeign.
All request and response body directions are enabled by default, but integrations collect body content only where supported:
- Spring MVC collects incoming request bodies.
- Apollo 3 and 4 collect outgoing request and incoming response bodies for captured HTTP client errors.
- GraphQL Java collects outgoing response bodies when reporting GraphQL errors.
Other HTTP integrations may collect body-size metadata without collecting body content. Body-size metadata remains available when content collection is disabled.
Use dataCollection.httpBodies to choose which directions to collect or an empty set to disable body content collection.
For Spring and Spring Boot, incoming request body content is limited to JSON and form bodies that meet the configured maxRequestBodySize. The default is NONE, so incoming request body content isn't collected until this option is configured.
Our build tool plugins for Gradle and Maven can upload your source code to Sentry, which can then used to show the lines of code where an error happened in the Issue Details page.
To opt into sending this source context to Sentry, you have to enable the feature as described in the Source Context documentation.
File I/O instrumentation collects file names and absolute paths by default. Set dataCollection.filePaths=false to omit them. File extensions and byte counts remain available when paths are disabled.
By default the Sentry SDK does not send unencoded Logback messages and parameters if an encoder has been set. It will however send the encoded message.
Set includeUnencodedMessage=true on the Sentry appender to include the original message and parameters. Data Collection doesn't filter log messages or breadcrumb content. Use beforeBreadcrumb for breadcrumbs, beforeSend for events, or options.getLogs().setBeforeSend(...) for Sentry Logs when you need application-specific filtering.
GraphQL document and variable collection default to true. Use dataCollection.graphql.document and dataCollection.graphql.variables to disable either category. Operation metadata used for tracing and grouping can still be collected when document or variable content is disabled.
Data Collection doesn't filter attributes added by OpenTelemetry instrumentation or your application. Configure the instrumentation that produces them, or scrub them with beforeSendTransaction.
While SQL queries are sent to Sentry, neither the full SQL query (UPDATE app_user SET password='supersecret' WHERE id=1;), nor the values of its parameters will ever be sent. A parameterized version of the query (UPDATE app_user SET password=? WHERE id=?;) is sent instead.
Our documentation is open source and available on GitHub. Your contributions are welcome, whether fixing a typo (drat!) or suggesting an update ("yeah, this would be better").