OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization

--- description: OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization - Enforces strict boundary sanitization and authenticated re-binding of OpenTelemetry W3C Baggage headers at API ingress boundaries. Forwarding raw, untrusted client-supplied baggage enables cross-tenant identity spoofing, downstream trace attribute poisoning, and data isolation breaches in observability pipelines. Ingress layers must drop or strictly validate client baggage and rebuild context exclusively from cryptographically verified authentication tokens. globs: src/middleware/**/*.{ts,js}, src/gateway/**/*.{ts,js}, src/instrumentation/**/*.{ts,js}, src/tracing/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-w3c-baggage-tenant-isolation" --- # OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Blind Context Propagation of Untrusted W3C Inbound Baggage Across Multi-Tenant Microservice Boundaries ## System Constraints You are a Principal Software Architect enforcing enterprise-grade OpenTelemetry multi-tenant context boundary controls. Ensure all code rigorously validates, strips, or reconstructs W3C Baggage at edge gateways. Never allow unauthenticated client-injected baggage entries (such as tenant.id, account.id, or role) to traverse downstream services or pollute trace telemetry. ## Strict Guidelines - Services MUST strip untrusted inbound `baggage` HTTP headers at the outer network ingress gateway before downstream context extraction. - Engineers MUST extract tenant identifiers strictly from authenticated and cryptographically verified identity claims (e.g., verified JWT payload or mTLS SAN), NEVER from raw client headers or untrusted baggage. - Ingress middleware MUST synthesize an isolated, new `Baggage` instance populated exclusively with allowlisted, internal metadata keys. - Components NEVER blindly pass `propagation.extract(ROOT_CONTEXT, req.headers)` to downstream spans without sanitizing tenant boundary metadata. - Downstream internal RPC clients MUST ensure tracing contexts are propagated with explicit tenant isolation tags and immutable key-value pairs. ## Bad vs Good Implementations ### Ingress Baggage Sanitization and Authenticated Context Reconstitution #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly extracting OpenTelemetry context from raw HTTP headers blindly accepts and forwards client-controlled W3C baggage. Attackers can forge tenant boundaries, pollute observability backends with high-cardinality injection attacks, and spoof role-based metadata consumed by downstream services. ```typescript import { Request, Response, NextFunction } from 'express'; import { context, propagation } from '@opentelemetry/api'; export function tracingMiddleware(req: Request, res: Response, next: NextFunction): void { // VULNERABLE: Direct extraction propagates untrusted, client-supplied baggage headers. // An attacker can inject 'baggage: tenant.id=target-tenant,user.role=admin' to spoof // tenancy in downstream services and poison distributed tracing data. const extractedContext = propagation.extract(context.active(), req.headers); context.with(extractedContext, () => { next(); }); } ``` #### Production Standard (Correct) > **Standard**: The secure implementation actively strips inbound client baggage, extracts only the trace propagation headers, and explicitly reconstructs a fresh Baggage container using authenticated, cryptographically validated tenant attributes. Downstream services receive guaranteed, poison-free context. ```typescript import { Request, Response, NextFunction } from 'express'; import { context, propagation, trace, baggageEntryMetadataEmpty } from '@opentelemetry/api'; interface AuthenticatedRequest extends Request { user?: { tenantId: string; userId: string }; } export function secureTracingMiddleware(req: AuthenticatedRequest, res: Response, next: NextFunction): void { // 1. Extract W3C TraceContext (traceparent/tracestate) only, ignoring inbound baggage const carrierWithoutBaggage = { ...req.headers }; delete carrierWithoutBaggage['baggage']; const traceContext = propagation.extract(context.active(), carrierWithoutBaggage); // 2. Validate tenant existence from cryptographically verified authentication state if (!req.user?.tenantId) { res.status(401).json({ error: 'Unauthorized: Missing verified tenant context' }); return; } // 3. Reconstruct a clean, sanitized Baggage bag using verified identity claims const verifiedBaggage = propagation.createBaggage({ 'tenant.id': { value: req.user.tenantId, metadata: baggageEntryMetadataEmpty(), }, 'user.id': { value: req.user.userId, metadata: baggageEntryMetadataEmpty(), } }); // 4. Bind sanitized baggage to verified trace context const isolatedContext = propagation.setBaggage(traceContext, verifiedBaggage); context.with(isolatedContext, () => { const activeSpan = trace.getActiveSpan(); if (activeSpan) { activeSpan.setAttribute('tenant.id', req.user.tenantId); } next(); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization

OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization defines an industrial-grade behavioral standard for devops engineering. Enforces strict boundary sanitization and authenticated re-binding of OpenTelemetry W3C Baggage headers at API ingress boundaries. Forwarding raw, untrusted client-supplied baggage enables cross-tenant identity spoofing, downstream trace attribute poisoning, and data isolation breaches in observability pipelines. Ingress layers must drop or strictly validate client baggage and rebuild context exclusively from cryptographically verified authentication tokens. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind Context Propagation of Untrusted W3C Inbound Baggage Across Multi-Tenant Microservice Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind Context Propagation of Untrusted W3C Inbound Baggage Across Multi-Tenant Microservice Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST strip untrusted inbound `baggage` HTTP headers at the outer network ingress gateway before downstream context extraction.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.