When data_collection.http_headers.request is configured in allowlist mode and "host" is not among the allowed terms, _filter_headers (in _wsgi_common.py) legitimately substitutes the host value with "[Filtered]". However, _get_request_data and _get_request_attributes in _asgi_common.py then pass headers.get("host") — now the substituted string "[Filtered]" — directly into _get_url. Because "[Filtered]" is truthy, _get_url builds URLs such as http://[Filtered]/path instead of falling back to the ASGI server field, corrupting the reported request URL. Previously host was never filtered (it is not in SENSITIVE_HEADERS), so this is a regression introduced by routing header filtering through the data-collection config. The fix belongs in _asgi_common.py: derive the host used for URL construction from the raw headers/scope rather than from the scrubbed headers.

In test_sensitive_header_passthrough_with_pii_span_streaming, use if expected is None instead of if request.node.callspec.id == "data_collection_off_does_not_add_headers". If the parametrize ID is ever renamed, the intended branch is silently skipped and the else branch runs expected["authorization"] on None, raising a TypeError. Keying on the semantically-meaningful expected value is more robust.

The if request.node.callspec.id == "data_collection_off_does_not_add_headers": guard should instead use if expected is None:. If the parametrize ID is ever renamed, the condition silently falls through to the else branch and immediately raises TypeError: 'NoneType' object is not subscriptable on expected["authorization"], producing a confusing failure rather than the intended assertion about absent headers.