OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement

--- description: OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement - Mandates strict schema allowlists, size ceiling quotas, and taint-tracking for OpenTelemetry W3C Baggage propagation across microservice boundaries. Prevents distributed header amplification DoS vectors (HTTP 431 Request Header Fields Too Large) and lateral sensitive metadata exfiltration by pruning unverified baggage entries at ingress and egress gateways. globs: src/telemetry/**/*.{ts,js}, src/middleware/**/*.{ts,js}, src/tracing/**/*.{ts,js}, src/clients/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-baggage-taint-tracking-size-ceiling" --- # OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unfiltered Baggage Passthrough and Unbounded Distributed Header Accumulation ## System Constraints You are a Principal Infrastructure & Security Architect enforcing OpenTelemetry W3C Baggage hygiene. Mandate that incoming W3C Baggage is treated as untrusted user input subject to strict schema allowlists and byte quotas. Forbid unbounded propagation, header amplification, and sensitive data leakage across network boundaries. ## Strict Guidelines - Engineers MUST ALWAYS filter baggage against a strict key allowlist with regular expression validation on values during ingress and egress propagation. - Engineers MUST NOT transparently forward incoming W3C Baggage to upstream or downstream services without sanitization and size enforcement. - Services MUST enforce strict byte quotas: total serialized baggage MUST NOT exceed 8192 bytes, individual entries MUST NOT exceed 4096 bytes, and member count MUST NOT exceed 64 items. - Components NEVER store sensitive identifiers, authorization tokens, PII, or raw external input in baggage entries. - Trace propagation wrappers MUST strip untrusted or tainted baggage before injecting context into outbound HTTP/gRPC client requests. ## Bad vs Good Implementations ### Unfiltered Baggage Propagation vs. Schema-Allowlisted Size-Capped Sanitizer #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly adopting unvalidated inbound baggage into context exposes downstreams to HTTP 431 header amplification crashes and allows attackers to traverse microservice boundaries with injected or exfiltrated payloads. ```typescript import { context, propagation } from '@opentelemetry/api'; import { Request, Response, NextFunction } from 'express'; export function telemetryMiddleware(req: Request, res: Response, next: NextFunction) { // VULNERABLE: Extracts unvalidated W3C baggage directly from incoming headers // and automatically injects it into outbound requests without size ceilings or allowlists. // Allows distributed header amplification attacks (HTTP 431) and metadata exfiltration. const incomingContext = propagation.extract(context.active(), req.headers); context.with(incomingContext, () => { next(); }); } ``` #### Production Standard (Correct) > **Standard**: Enforces an allowlist of permitted baggage keys, validates each value using strict regex, limits total member count, and caps cumulative header size to prevent amplification attacks and data exfiltration. ```typescript import { context, propagation, baggageEntryMetadataSymbol, Baggage, BaggageEntry } from '@opentelemetry/api'; import { Request, Response, NextFunction } from 'express'; const MAX_TOTAL_BAGGAGE_BYTES = 8192; const MAX_MEMBER_COUNT = 64; const ALLOWLISTED_KEYS = new Map<string, RegExp>([ ['tenant.id', /^[a-zA-Z0-9_-]{1,64}$/], ['traffic.tier', /^(free|standard|enterprise)$/], ['region.origin', /^[a-z]{2}-[a-z]+-\d$/] ]); export function sanitizeBaggage(incoming: Baggage): Baggage { let sanitized = propagation.createBaggage(); let totalBytes = 0; let count = 0; for (const [key, entry] of incoming.getAllEntries()) { if (count >= MAX_MEMBER_COUNT) break; const pattern = ALLOWLISTED_KEYS.get(key); if (!pattern || !pattern.test(entry.value)) continue; const entryBytes = Buffer.byteLength(key, 'utf8') + Buffer.byteLength(entry.value, 'utf8'); if (totalBytes + entryBytes > MAX_TOTAL_BAGGAGE_BYTES) break; sanitized = sanitized.setEntry(key, entry); totalBytes += entryBytes; count++; } return sanitized; } export function secureTelemetryMiddleware(req: Request, res: Response, next: NextFunction) { const extractedContext = propagation.extract(context.active(), req.headers); const rawBaggage = propagation.getBaggage(extractedContext); const safeContext = rawBaggage ? propagation.setBaggage(extractedContext, sanitizeBaggage(rawBaggage)) : extractedContext; context.with(safeContext, () => { next(); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement

OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement defines an industrial-grade behavioral standard for devops engineering. Mandates strict schema allowlists, size ceiling quotas, and taint-tracking for OpenTelemetry W3C Baggage propagation across microservice boundaries. Prevents distributed header amplification DoS vectors (HTTP 431 Request Header Fields Too Large) and lateral sensitive metadata exfiltration by pruning unverified baggage entries at ingress and egress gateways. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unfiltered Baggage Passthrough and Unbounded Distributed Header Accumulation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unfiltered Baggage Passthrough and Unbounded Distributed Header Accumulation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS filter baggage against a strict key allowlist with regular expression validation on values during ingress and egress propagation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.