@spotify-confidence/csr-recorder 0.17.17 → 0.17.18

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.17.18](https://github.com/spotify/confidence-sdk-js/compare/csr-recorder-v0.17.17...csr-recorder-v0.17.18) (2026-09-09)
+
+
+### 🐛 Bug Fixes
+
+* strip query and hash from recording URLs ([#452](https://github.com/spotify/confidence-sdk-js/issues/452)) ([1ce37f3](https://github.com/spotify/confidence-sdk-js/commit/1ce37f3f43c05bfea4a90839a6de42314096bb40))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @spotify-confidence/csr-common bumped to 0.18.10
+
 ## [0.17.17](https://github.com/spotify/confidence-sdk-js/compare/csr-recorder-v0.17.16...csr-recorder-v0.17.17) (2026-09-07)
 
 

package/README.md

@@ -53,7 +53,7 @@ const stop = record(event => {}, {
 });
 ```
 
-The same parameterization is also applied to the `href` in rrweb Meta events.
+The same parameterization is also applied to the `href` in rrweb Meta events. Query strings and fragments are removed from Meta event URLs and the session's document referrer before recording.
 
 ## rrweb version
 

package/dist/index.cjs

@@ -221,12 +221,13 @@ var Recorder = class Recorder {
 		};
 	}
 	parameterizeHref(href) {
+		const strippedHref = (0, _spotify_confidence_csr_common.stripUrlQueryAndHash)(href);
 		try {
-			const url = new URL(href);
+			const url = new URL(strippedHref);
 			url.pathname = this.parameterizeRoute(url.pathname);
 			return url.toString();
 		} catch (_e) {
-			return this.parameterizeRoute(href);
+			return this.parameterizeRoute(strippedHref);
 		}
 	}
 	emitRouteChange(from, to, trigger) {

package/dist/index.js

@@ -1,4 +1,4 @@
-import { RecordingEventType, RecordingPluginName } from "@spotify-confidence/csr-common";
+import { RecordingEventType, RecordingPluginName, stripUrlQueryAndHash } from "@spotify-confidence/csr-common";
 //#region src/types.ts
 const DEFAULT_MASK_SELECTORS = ["[data-csr-mask]"];
 const DEFAULT_BLOCK_SELECTORS = ["[data-csr-block]", "video"];
@@ -220,12 +220,13 @@ var Recorder = class Recorder {
 		};
 	}
 	parameterizeHref(href) {
+		const strippedHref = stripUrlQueryAndHash(href);
 		try {
-			const url = new URL(href);
+			const url = new URL(strippedHref);
 			url.pathname = this.parameterizeRoute(url.pathname);
 			return url.toString();
 		} catch (_e) {
-			return this.parameterizeRoute(href);
+			return this.parameterizeRoute(strippedHref);
 		}
 	}
 	emitRouteChange(from, to, trigger) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotify-confidence/csr-recorder",
   "license": "Apache-2.0",
-  "version": "0.17.17",
+  "version": "0.17.18",
   "repository": {
     "type": "git",
     "url": "https://github.com/spotify/confidence-sdk-js.git",
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@rrweb/rrweb-plugin-console-record": "^2.0.1",
-    "@spotify-confidence/csr-common": "0.18.9",
+    "@spotify-confidence/csr-common": "0.18.10",
     "rrweb": "^2.0.1"
   },
   "module": "./dist/index.js",

package/src/recorder-routing.test.ts

@@ -234,21 +234,59 @@ describe('Recorder route change capture', () => {
     recorder.stop();
   });
 
+  it.each([
+    ['https://example.com/users/123?email=alice@example.com#token', 'https://example.com/users/:id'],
+    ['https://example.com/users/123#token?email=alice@example.com', 'https://example.com/users/:id'],
+    ['https://example.com/users/123?email=alice@example.com', 'https://example.com/users/:id'],
+    ['https://example.com/users/123#token', 'https://example.com/users/:id'],
+    ['/users/123?email=alice@example.com#token', '/users/:id'],
+    ['invalid-url?email=alice@example.com#token', 'invalid-url'],
+    ['', ''],
+  ])('strips query/hash from Meta href %s even with route capture disabled', (href, expected) => {
+    const engine = new MockEngine();
+    const event: RecordingEvent = {
+      type: RecordingEventType.Meta,
+      timestamp: 1,
+      data: { href, width: 1920, height: 1080 },
+    };
+    engine.eventsOnStart = [event];
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine, onEvent });
+    recorder.start({ captureRouteChanges: false });
+    // Later snapshots must be sanitized too.
+    engine.emit(event);
+
+    expect(onEvent).toHaveBeenCalledTimes(2);
+    for (const [recorded] of onEvent.mock.calls) {
+      expect(recorded).toEqual({ ...event, data: { ...event.data, href: expected } });
+    }
+    expect(event.data).toEqual({ href, width: 1920, height: 1080 });
+
+    recorder.stop();
+  });
+
   it('parameterizes meta href using custom parameterizeRoute', () => {
     const engine = new MockEngine();
     engine.eventsOnStart = [
       {
         type: RecordingEventType.Meta,
         timestamp: 1,
-        data: { href: 'https://example.com/teams/acme-corp/dashboard', width: 1920, height: 1080 },
+        data: {
+          href: 'https://example.com/teams/acme-corp/dashboard?email=alice@example.com#token',
+          width: 1920,
+          height: 1080,
+        },
       },
     ];
     const onEvent = vi.fn();
     const recorder = new Recorder({ engine, onEvent });
+    const parameterizeRoute = vi.fn((route: string) => route.replace(/\/teams\/[^/]+/, '/teams/:slug'));
     recorder.start({
-      parameterizeRoute: route => route.replace(/\/teams\/[^/]+/, '/teams/:slug'),
+      parameterizeRoute,
     });
 
+    expect(parameterizeRoute).toHaveBeenCalledWith('/teams/acme-corp/dashboard');
+
     const metaEvents = (onEvent.mock.calls as [RecordingEvent][])
       .map(([e]) => e)
       .filter(e => e.type === RecordingEventType.Meta);

package/src/recorder.ts

@@ -2,6 +2,7 @@ import {
   RecordingEvent,
   RecordingEventType,
   RecordingPluginName,
+  stripUrlQueryAndHash,
   type TabVisibilityPluginData,
   type NetworkRequestPluginData,
   type RouteChangePluginData,
@@ -202,12 +203,13 @@ export class Recorder {
   }
 
   private parameterizeHref(href: string): string {
+    const strippedHref = stripUrlQueryAndHash(href);
     try {
-      const url = new URL(href);
+      const url = new URL(strippedHref);
       url.pathname = this.parameterizeRoute(url.pathname);
       return url.toString();
     } catch (_e) {
-      return this.parameterizeRoute(href);
+      return this.parameterizeRoute(strippedHref);
     }
   }