OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction

--- description: OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction - Enforces strict allowlist validation and deterministic redaction on OpenTelemetry W3C Baggage propagators at all microservice ingress points. Prevents covert data exfiltration and credential leaks by intercepting inbound headers before context propagation across distributed service mesh topologies. globs: src/tracing/**/*.{ts,js}, src/telemetry/**/*.{ts,js}, src/middleware/**/*.{ts,js}, src/instrumentation/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-w3c-baggage-pii-stripping-standard" --- # OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Default Pass-Through of Untrusted W3C Baggage Ingress Spilling PII Across Microservices ## System Constraints You are a Principal Security Architect and Distributed Tracing SME. You must enforce deterministic redaction and strict allowlist filtering of W3C Baggage metadata at API gateway and service ingress boundaries. Untrusted or unvalidated baggage entries must never be propagated downstream. ## Strict Guidelines - Engineers MUST ALWAYS wrap the standard W3C Baggage propagator with a deterministic allowlist filter before registering global OpenTelemetry propagators. - Engineers MUST NOT allow default W3C baggage propagators to parse and inject arbitrary unverified user claims (e.g., email, SSN, tokens, bearer headers) directly into active trace contexts. - Inbound baggage keys MUST match a strict compile-time or environment-driven allowlist (e.g., transaction.id, region, tenant.tier) before propagation. - Services MUST drop or sanitize unapproved baggage keys at the edge/ingress layer before propagating Context downstream to RPC or HTTP clients. - Telemetry interceptors NEVER log unsanitized W3C baggage header strings into trace attributes or plain-text diagnostic logs. ## Bad vs Good Implementations ### Configuring Sanitized W3C Baggage Propagator vs Direct Pass-Through #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using standard W3CBaggagePropagator without an interceptor creates a side-channel leak. External callers can inject arbitrary PII headers like 'baggage: [email protected],jwt=secret' which propagate unhindered across all downstream services and span attributes. ```typescript import { CompositePropagator, W3CTraceContextPropagator, W3CBaggagePropagator } from '@opentelemetry/core'; import { propagation } from '@opentelemetry/api'; // ANTI-PATTERN: Default BaggagePropagator injects all incoming baggage directly, // allowing downstream microservices to blindly inherit PII and sensitive user claims. propagation.setGlobalPropagator( new CompositePropagator({ propagators: [ new W3CTraceContextPropagator(), new W3CBaggagePropagator(), ], }) ); ``` #### Production Standard (Correct) > **Standard**: The SanitizedBaggagePropagator wraps the native W3C propagator and applies an explicit allowlist constraint on all incoming baggage keys during context extraction, deterministically stripping unvetted claims, authentication tokens, and PII before downstream propagation. ```typescript import { Context, TextMapGetter, TextMapPropagator, TextMapSetter, baggageEntryMetadataSymbol, propagation } from '@opentelemetry/api'; import { CompositePropagator, W3CTraceContextPropagator, W3CBaggagePropagator } from '@opentelemetry/core'; const ALLOWED_BAGGAGE_KEYS = new Set(['tenant.id', 'routing.region', 'client.version']); export class SanitizedBaggagePropagator implements TextMapPropagator { private readonly delegate = new W3CBaggagePropagator(); inject(context: Context, carrier: unknown, setter: TextMapSetter): void { this.delegate.inject(context, carrier, setter); } extract(context: Context, carrier: unknown, getter: TextMapGetter): Context { const extractedContext = this.delegate.extract(context, carrier, getter); const currentBaggage = propagation.getBaggage(extractedContext); if (!currentBaggage) return extractedContext; let sanitizedBaggage = propagation.createBaggage(); for (const [key, entry] of currentBaggage.getAllEntries()) { if (ALLOWED_BAGGAGE_KEYS.has(key)) { sanitizedBaggage = sanitizedBaggage.setEntry(key, entry); } } return propagation.setBaggage(extractedContext, sanitizedBaggage); } fields(): string[] { return this.delegate.fields(); } } propagation.setGlobalPropagator( new CompositePropagator({ propagators: [ new W3CTraceContextPropagator(), new SanitizedBaggagePropagator(), ], }) ); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction

OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction defines an industrial-grade behavioral standard for devops engineering. Enforces strict allowlist validation and deterministic redaction on OpenTelemetry W3C Baggage propagators at all microservice ingress points. Prevents covert data exfiltration and credential leaks by intercepting inbound headers before context propagation across distributed service mesh topologies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Default Pass-Through of Untrusted W3C Baggage Ingress Spilling PII Across Microservices Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Default Pass-Through of Untrusted W3C Baggage Ingress Spilling PII Across Microservices	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS wrap the standard W3C Baggage propagator with a deterministic allowlist filter before registering global OpenTelemetry propagators.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.