http.response.header

Instrumentations SHOULD require an explicit configuration of which headers are to be captured. Including all response headers can be a security risk - explicit configuration helps avoid leaking sensitive information.

Users MAY explicitly configure instrumentations to capture them even though it is not recommended.

The attribute value MUST consist of either multiple header values as an array of strings or a single-item array containing a possibly comma-concatenated string, depending on the way the HTTP library provides access to headers.

Examples:

- A header Content-Type: application/json header SHOULD be recorded as the http.request.response.content-type attribute with value ["application/json"]. - A header My-custom-header: abc, def header SHOULD be recorded as the http.response.header.my-custom-header attribute with value ["abc", "def"] or ["abc, def"] depending on the HTTP library.