URL parameters should be masked/maskable

[ma7moudat]

URLs can sometimes contain parameters (e.g. the ID of a user /profile?userId=abc or an order /order/{orderId}), that can be traced back to specific users. This could be a violation of some privacy regulations and there should be a way to configure Clarity to mask specify portions of the URL.

Is there such a possibility? So far I have found nothing in the documentation. If no, are there any plans to implement it? Can it be considered for future releases?

[ClaritySupport]

@ma7moudat ,Currently Clarity don't support it, will consider this as feature request.

[ma7moudat]

Hi @ClaritySupport, Is there an update about this? Can we see planned features somewhere?

[ClaritySupport]

@ma7moudat , Clarity now supports URL parameter masking.The masking will be based on the URL parameter name (case sensitive). The masking will apply to all URLs in the project that use that URL parameter (you can’t apply it to only a subset of URLs). URL components cannot be masked.

Please share below details to our support alias ClarityMS@microsoft.com so that we can mask data from backend.

1. URL parameters to be masked.
2. Clarity project ID.

[ma7moudat]

Thank you for the quick reply @ClaritySupport

URL components cannot be masked.

So if a parameter is listed as a sub-directory in the URL structure (e.g. /order/{orderId}), it can't be masked?

Please share below details to our support alias ClarityMS@microsoft.com so that we can mask data from backend.

Can't I do that myself through the Clarity management console?

[ClaritySupport]

parameters that are part of the path, these are not supported. Only query parameters are.

Currently UI for masking Parameters to users is not available.

Thanks, Clarity Support Team Visit our docs!: https://docs.microsoft.com/en-us/clarityhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fclarity&data=05%7C01%7Cv-vidasa%40microsoft.com%7C343fe08f40a94e184c6408da28fedd21%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637867372409365494%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Q1zklwmipOGmVmg01HjPFwTVAwft75whSRoB8fFF%2BoY%3D&reserved=0 @.**@.> @.***

Confidentiality note: This e-mail, and any attachment to it, contains privileged and confidential information intended only for the use of the individual(s) or entity named in the e-mail. If the reader of the e-mail is not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, you are hereby notified that reading it is strictly prohibited. If you have received this e-mail in error, please immediately return it to the sender and delete it from your system.

From: Mahmoud @.> Sent: Monday, January 9, 2023 5:52 AM To: microsoft/clarity @.> Cc: Microsoft Clarity Support @.>; Mention @.> Subject: Re: [microsoft/clarity] URL parameters should be masked/maskable (Issue #305)

Thank you for the quick reply @ClaritySupporthttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FClaritySupport&data=05%7C01%7Cv-vikasd%40microsoft.com%7C02e9a832f32e4a39b9d508daf248ad1a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638088691264145498%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=vix6QDAJffTTS7QMEldcD%2FFLPdxsFRPGu3K7d4qQZdI%3D&reserved=0

URL components cannot be masked.

So if a parameter is listed as a sub-directory in the URL structure (e.g. /order/{orderId}), it can't be masked?

Please share below details to our support alias @.**@.> so that we can mask data from backend.

Can't I do that myself through the Clarity management console?

- Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmicrosoft%2Fclarity%2Fissues%2F305%23issuecomment-1375654497&data=05%7C01%7Cv-vikasd%40microsoft.com%7C02e9a832f32e4a39b9d508daf248ad1a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638088691264302156%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=odcVBi3LiHWi7GC1rEisxEZEDFzxRgQKcokoVJ5vcUI%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAW5BXQZSRJJFHF4XP6G6N6LWRQJX3ANCNFSM6AAAAAASGOJRSU&data=05%7C01%7Cv-vikasd%40microsoft.com%7C02e9a832f32e4a39b9d508daf248ad1a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638088691264302156%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=9rdtNwhCbaTzOwDOx8MppoaO%2B6bwY%2Bn%2Fz8G8VgACIYQ%3D&reserved=0. You are receiving this because you were mentioned.Message ID: @.**@.>>

[mhr-timroberts]

Are there any plans to include masking of URL path elements (e.g. /user/{userId})? Alternatively, would it be possible to provide an API that allows us to mask the URL from within our own code (it would need to work with single page apps), or allows us to supply/register a regex that is then used by the Clarity code to transform any URL prior to sending (e.g. a regex to mask any UUID found within the URL would be quite easy to construct)?

[ClaritySupport]

@mhr-timroberts , Will consider your feedback and add it to our product roadmap.