stangerjm commented 5 months ago

Which web client version did you detect this bug with?

v1.13.3

What environment (build systems, module system, and framework) did you detect this bug with?

TypeScript v5.0.2, Webpack v4.46.0, ECMAScript modules (ESM) and React v18.2.0

Is your web application a single page application (SPA) or multi page application (MPA)?

None

Please provide your web client configuration

{
     sessionSampleRate: 1,
     endpoint: 'https://dataplane.rum.us-west-2.amazonaws.com',
     telemetries: ['errors', 'performance', 'http'],
     allowCookies: true,
     disableAutoPageView: true,
     sessionAttributes: { title: 'override' },
}

Please describe the bug/issue

When aws-rum-web emits metrics from the browser, it will emit the title of the current page.

In my use-case, the page's title can contain sensitive customer information that I don't want to log. Trying to override this does not work and the client will not allow me to remove that metadata value or override it.

Currently the client does allow you to override certain metadata attributes such as domain. See https://github.com/aws-observability/aws-rum-web/pull/453 This is not possible with other attributes. We should be able to configure what data the client sends to RUM or override attributes to obfuscate them.

ps863 commented 5 months ago

Hi @stangerjm, There are few concerns we had in past with opening this up to other default attributes. Will discuss with the team and get back to you

qhanam commented 5 months ago

Thanks for raising this issue. I believe adopting #430 will resolve this. The concern was that users could get an app monitor into bad states by overriding default metadata. However, this risk seems acceptable if it solves critical use cases.