feat: add query stripping for self telemetry

README.md

@@ -25,6 +25,18 @@ const app = new ExpressKit(nodekit, {
 app.run();
 ```
 
+## Self telemetry
+
+By default, self telemetry sends the original request URL. Applications with large or
+high-cardinality query strings can strip query parameters before sending stats:
+
+```typescript
+const config: Partial<AppConfig> = {
+  appTelemetryChEnableSelfStats: true,
+  appTelemetryChSelfStatsStripQueryParams: true,
+};
+```
+
 ## CSP
 
 `config.ts`

src/router.ts

@@ -14,6 +14,12 @@
 } from './types';
 import {prepareCSRFMiddleware} from './csrf';
 
+function stripQueryString(url: string) {
+    const queryIndex = url.indexOf('?');
+
+    return queryIndex === -1 ? url : url.slice(0, queryIndex);
+}
+
 // Methods are lowercased to use it in `expressApp[method]`
 function isAllowedMethod(method: string): method is Lowercase<HttpMethod> | 'mount' {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -21,7 +27,7 @@
 }
 
 function wrapMiddleware(fn: AppMiddleware, i?: number): AppMiddleware {
     const result: AppMiddleware = async (req, res, next) => {
         const reqCtx = req.ctx;
         // Skip creating child context if parent is already ended (e.g. client disconnected).
         // Optional chaining for backward compatibility with nodekit < 2.5.0 (no abortSignal).
@@ -45,7 +51,7 @@
                 ctx.fail(error);
                 req.ctx = reqCtx;
                 next(error);
                 return;
             }
         }
     };
@@ -132,6 +138,11 @@
                     const disableSelfStats = Boolean(req.routeInfo.disableSelfStats);
 
                     if (!disableSelfStats) {
+                        // Stripping removes all query parameter values, so redaction is unnecessary in this mode.
+                        const requestUrl = ctx.config.appTelemetryChSelfStatsStripQueryParams
+                            ? stripQueryString(req.originalUrl)
+                            : ctx.utils.redactSensitiveQueryParams(req.originalUrl);
+
                         req.originalContext.stats({
                             service: 'self',
                             action: req.routeInfo.handlerName || UNNAMED_CONTROLLER,
@@ -140,7 +151,7 @@
                             requestId: req.originalContext.get(REQUEST_ID_PARAM_NAME) || '',
                             requestTime: req.originalContext.getTime(), // We have to use req.originalContext here to get full time
                             requestMethod: req.method,
-                            requestUrl: ctx.utils.redactSensitiveQueryParams(req.originalUrl),
+                            requestUrl,
                             traceId: req.originalContext.getTraceId() || '',
                             userId: req.originalContext.get(USER_ID_PARAM_NAME) || '',
                         });

src/tests/self-stats.test.ts

@@ -55,7 +55,10 @@ describe('self stats telemetry', () => {
         const agent = request.agent(app.express);
         const requestId = Math.random().toString();
 
-        await agent.get('/ping-self-stats').set(DEFAULT_REQUEST_ID_HEADER, requestId).expect(200);
+        await agent
+            .get('/ping-self-stats?filter=value')
+            .set(DEFAULT_REQUEST_ID_HEADER, requestId)
+            .expect(200);
 
         // last self stats data
         const stat = stats.mock.calls?.pop() || {};
@@ -67,12 +70,32 @@ describe('self stats telemetry', () => {
                 responseStatus: 200,
                 requestId,
                 requestMethod: 'GET',
-                requestUrl: '/ping-self-stats',
+                requestUrl: '/ping-self-stats?filter=value',
                 traceId: '',
             },
         ]);
     });
 
+    it('self stats telemetry strips query string when enabled', async () => {
+        const {app, stats} = setupApp({
+            config: {
+                appTelemetryChSelfStatsStripQueryParams: true,
+            },
+        });
+
+        const agent = request.agent(app.express);
+
+        await agent.get('/ping-self-stats?filter=value&filter=other').expect(200);
+
+        const stat = stats.mock.calls?.pop() || {};
+
+        expect(stat).toMatchObject([
+            {
+                requestUrl: '/ping-self-stats',
+            },
+        ]);
+    });
+
     it('self stats telemetry skipped', async () => {
         const {app, stats} = setupApp();
 

src/types.ts

@@ -49,6 +49,7 @@ declare module '@gravity-ui/nodekit' {
         appAfterAuthMiddleware?: AppMiddleware[];
 
         appTelemetryChEnableSelfStats?: boolean;
+        appTelemetryChSelfStatsStripQueryParams?: boolean;
 
         appLoggingOmitIdInMessages?: boolean;