Request cookie header and response headers are not being redacted

[david-luna]

Edited by @stevejgordon.

The agent is redacting request headers based on SanitizeFieldNames config. This list of names contains set-cookie name but not cookie resulting in transactions with request cookies not being redacted. The agent must redact the cookies based on that config. Response headers are also currently not being sanitized.

Other agents like Java & Python are parsing the cookies into an object and place it in context.request.cookies which is accepted by the intake API then sanitization is applied for each cookie individually. The cookie header itself is removed or redacted (it varies from implementation)