Remove userId from baggage due to PII (#2157)

Author: marandaneto

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Fixes
 
 - Only send userid in Dynamic Sampling Context if sendDefaultPii is true ([#2147](https://github.com/getsentry/sentry-java/pull/2147))
+- Remove userId from baggage due to PII ([#2157](https://github.com/getsentry/sentry-java/pull/2157))
 
 ### Features
 

sentry/src/main/java/io/sentry/TraceContext.java

@@ -56,17 +56,21 @@ public final class TraceContext implements JsonUnknown, JsonSerializable {
       final @Nullable User user,
       final @NotNull SentryOptions sentryOptions,
       final @Nullable TracesSamplingDecision samplingDecision) {
+    // user_id isn't part of the dynamic sampling context right now because
+    // of PII concerns.
+    // https://develop.sentry.dev/sdk/performance/dynamic-sampling-context/#the-temporal-problem
     this(
         transaction.getSpanContext().getTraceId(),
         new Dsn(sentryOptions.getDsn()).getPublicKey(),
         sentryOptions.getRelease(),
         sentryOptions.getEnvironment(),
-        getUserId(sentryOptions, user),
+        null, // getUserId(sentryOptions, user),
         user != null ? getSegment(user) : null,
         transaction.getName(),
         sampleRateToString(sampleRate(samplingDecision)));
   }
 
+  @SuppressWarnings("UnusedMethod")
   private static @Nullable String getUserId(
       final @NotNull SentryOptions options, final @Nullable User user) {
     if (options.isSendDefaultPii() && user != null) {

sentry/src/test/java/io/sentry/SentryTracerTest.kt

@@ -496,7 +496,7 @@ class SentryTracerTest {
             assertEquals("environment", it.environment)
             assertEquals("[email protected]", it.release)
             assertEquals(transaction.name, it.transaction)
-            assertEquals("user-id", it.userId)
+            // assertEquals("user-id", it.userId)
             assertEquals("pro", it.userSegment)
         }
     }
@@ -569,7 +569,7 @@ class SentryTracerTest {
             assertTrue(it.value.contains("sentry-release=1.0.99-rc.7,"))
             assertTrue(it.value.contains("sentry-environment=production,"))
             assertTrue(it.value.contains("sentry-transaction=name,"))
-            assertTrue(it.value.contains("sentry-user_id=userId12345,"))
+            // assertTrue(it.value.contains("sentry-user_id=userId12345,"))
             assertTrue(it.value.contains("sentry-user_segment=pro$".toRegex()))
         }
     }