Set ip_address to {{auto}} by default, even if sendDefaultPII is disabled

[bruno-garcia]

Similar to:

• Set ip_address = {{auto}} by default sentry-java#2860

This is the behavior of the JavaScript and Apple (Cocoa) SDK, and now of the Android SDK (v7) which we already merged into main and shipped on 4.0.0-beta.3

[bruno-garcia]

@bitsandfoxes there was a thread on Slack confirming this. It's a small change code-wise but large in impact, we need to be clear on the changelog. cc @Giorgi

[smino-dev]

Hey Sentry, we came across this change and are a bit worried about this. Our software needs to be GDPR compliant and for now we set sendDefaultPII always to false, because we do not want to send the IP to sentry. How do you filter out those IP Addresses now if the option is on sentry.io? Does the IP get sent to sentry and it gets then discarded there?

Or how can we achieve to not sent the IP Address to sentry at all? Do we have to set sendDefaultPII to true and create our own SentryUserFactory where set the IP to null?

[jamescrosswell]

How do you filter out those IP Addresses now if the option is on sentry.io?

Hey @smino-dev,

There's a description of this in the 4.0.0 changelog

The "Prevent Storing of IP Addresses" option in the "Security & Privacy" project settings on sentry.io can be used to control this instead

[smino-dev]

Thanks @jamescrosswell I've came across this option already but we are wondering how this filtering is done technically? If e.g. a sentry transaction or exception is sent to sentry, where does this IP Address gets filtered out? On our API or somewhere on a sentry server? Because if it is done the second way, we could not upgrade to latest version of sentry, as this would break our GDPR Compliance, except there is another way.

Thanks already for answering!

[jamescrosswell]

On our API or somewhere on a sentry server?

That I'm not sure of... maybe best to ask on Discord (referencing this chat here).

[bruno-garcia]

or exception is sent to sentry, where does this IP Address gets filtered out?

{{auto}} on the event instructs Relay to use the IP address of the connection.

we could not upgrade to latest version of sentry, as this would break our GDPR Compliance, except there is another way.

If you can't have the IP address of the connection (you probably do on your web server logs fwiw) you can disable this in the project settings. Sentry will then no longer add the connection IP to the event.