Repository navigation
Default config still sends client IPs in CF-Connecting-IP, True-Client-IP, Forwarded and X-Client-IP headers #8097
Description
How do you use Sentry?
Sentry Saas (sentry.io)
Version
2.72.0 (also on master)
Steps to Reproduce
Default config, no send_default_pii, no data_collection:
import sentry_sdk
from flask import Flask
seen = []
sentry_sdk.init(dsn="http://k@localhost/1", transport=lambda event: seen.append(event))
app = Flask(__name__)
app.logger.disabled = True
@app.route("/")
def index():
raise ValueError("boom")
ips = {
"X-Forwarded-For": "203.0.113.1",
"X-Real-IP": "203.0.113.2",
"CF-Connecting-IP": "203.0.113.3",
"True-Client-IP": "203.0.113.4",
"Forwarded": "for=203.0.113.5",
"X-Client-IP": "203.0.113.6",
}
app.test_client().get("/", headers=ips)
sentry_sdk.flush()
sent = {k.lower(): v for k, v in seen[0]["request"]["headers"].items()}
for name in ips:
print(f"{name:18} {sent.get(name.lower(), '(not sent)') or '(blanked)'}")Expected Result
No client IP in the event. The docs say "By default, the Sentry SDK doesn't send the user's IP address" (https://docs.sentry.io/platforms/python/data-management/data-collected/).
Actual Result
X-Forwarded-For (blanked)
X-Real-IP (blanked)
CF-Connecting-IP 203.0.113.3
True-Client-IP 203.0.113.4
Forwarded for=203.0.113.5
X-Client-IP 203.0.113.6
The default only blanks X-Forwarded-For and X-Real-IP (SENSITIVE_ENV_KEYS in integrations/_wsgi_common.py). Same on transactions and streamed spans. The terms in data_collection.py ("forwarded", "-ip", "remote-", "via", "-user") would cover these, but the default path doesn't use them for headers.
Activity
linear-code commentedon Oct 21, 2026
PY-3030