Can I strip query-string PII before Croct records the page URL?
Some of our URLs carry sensitive stuff in the query string, for example /reset?token=abc123&email=user@example.com. I do not want those values captured when Croct records page views.
Is there a hook to sanitize the URL before it gets tracked? I would rather clean it at the source than deal with it downstream.
1 answer
Yes. The plug urlSanitizer option is a callback that lets you rewrite or strip parts of the URL before it is recorded, so the cleaning happens at the source.
It applies to the page URL captured with page events such as pageOpened and pageLoaded, so once configured it covers your auto-tracked page views. A typical use is dropping sensitive query parameters while keeping the path intact for targeting:
croct.plug({ appId: 'APPLICATION_ID', urlSanitizer: url => { const sanitized = new URL(url);
sanitized.searchParams.delete('token'); sanitized.searchParams.delete('email');
return sanitized; },});One thing to keep in mind: CQL still matches on page path and query, so sanitize only the fields you do not need for targeting. The callback is documented in the plug options reference for urlSanitizer, and the events it affects are listed under tracking events.