Skip to content

feat(astro): Serve the managed tunnel from the Sentry middleware - #25419

Draft
logaretm wants to merge 7 commits into
awad/tunnel-nitrofrom
awad/tunnel-astro
Draft

feat(astro): Serve the managed tunnel from the Sentry middleware#25419
logaretm wants to merge 7 commits into
awad/tunnel-nitrofrom
awad/tunnel-astro

Conversation

@logaretm

@logaretm logaretm commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This PR adds the tunnel wiring to the astro SDK. We already had a global middleware active, so it works by adding logic to check if the incoming request is a tunnel request and if it is, then it will be handled.

This also respects the decision made earlier to follow the base path configured by the user.

closes #25463

@logaretm
logaretm added this pull request to stack #25201 October 15, 2026 16:04
@github-actions

github-actions Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 30.53 kB +2.18% +649 B 🔺
@sentry/browser - with treeshaking flags 28.51 kB +1.75% +490 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing 28.39 kB +1.7% +473 B 🔺
@sentry/browser (incl. Tracing) 52.77 kB +1.35% +699 B 🔺
@sentry/browser (incl. Tracing + Span Streaming) 52.77 kB +1.35% +698 B 🔺
@sentry/browser (incl. Tracing, Profiling) 55.74 kB +1.32% +721 B 🔺
@sentry/browser (incl. Tracing, Replay) 92.44 kB +0.68% +616 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 81.18 kB +0.62% +496 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas) 97.18 kB +0.66% +629 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback) 110.17 kB +0.63% +683 B 🔺
@sentry/browser (incl. Feedback) 48.09 kB +1.48% +699 B 🔺
@sentry/browser (incl. sendFeedback) 35.6 kB +1.9% +662 B 🔺
@sentry/browser (incl. FeedbackAsync) 40.73 kB +1.71% +683 B 🔺
@sentry/browser (incl. Metrics) 31.54 kB +2.05% +633 B 🔺
@sentry/browser (incl. Logs) 31.81 kB +2.01% +626 B 🔺
@sentry/browser (incl. Metrics & Logs) 32.48 kB +2.11% +670 B 🔺
@sentry/react 32.33 kB +2% +631 B 🔺
@sentry/react (incl. Tracing) 55.02 kB +1.17% +633 B 🔺
@sentry/vue 38.68 kB +1.7% +643 B 🔺
@sentry/vue (incl. Tracing) 55.72 kB +1.31% +716 B 🔺
@sentry/svelte 30.56 kB +2.2% +657 B 🔺
@sentry/remix (Remix 3 client bundle) 57.8 kB +1.26% +715 B 🔺
CDN Bundle 32.11 kB +1.49% +470 B 🔺
CDN Bundle (incl. Tracing) 53.06 kB +0.91% +478 B 🔺
CDN Bundle (incl. Logs, Metrics) 34.31 kB +1.41% +474 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) 55.01 kB +0.89% +483 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) 75.26 kB +0.66% +492 B 🔺
CDN Bundle (incl. Tracing, Replay) 90.73 kB +0.53% +478 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 92.66 kB +0.52% +479 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) 96.87 kB +0.49% +468 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 98.83 kB +0.5% +489 B 🔺
CDN Bundle - uncompressed 94.33 kB +1.24% +1.15 kB 🔺
CDN Bundle (incl. Tracing) - uncompressed 157.19 kB +0.74% +1.15 kB 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed 100.87 kB +1.16% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 163.14 kB +0.72% +1.15 kB 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 230.91 kB +0.51% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed 277.35 kB +0.42% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 283.3 kB +0.41% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 291.06 kB +0.4% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 296.99 kB +0.39% +1.15 kB 🔺
@sentry/nextjs (client) 57.45 kB +1.08% +613 B 🔺
@sentry/sveltekit (client) 53.24 kB +1.51% +789 B 🔺
@sentry/core/server 42.78 kB +4.01% +1.65 kB 🔺
@sentry/core/browser 13.81 kB - -
@sentry/node 155.73 kB +0.42% +644 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 84.06 kB - -
@sentry/node - without tracing 97.41 kB +0.66% +633 B 🔺
@sentry/node - without channel injection 133.72 kB +0.46% +608 B 🔺
@sentry/aws-serverless 105.63 kB +0.67% +695 B 🔺
@sentry/cloudflare (withSentry) - minified 212.86 kB +0.94% +1.97 kB 🔺
@sentry/cloudflare (withSentry) 527.93 kB +0.92% +4.76 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified 230.54 kB +0.87% +1.97 kB 🔺

View base workflow run

@logaretm
logaretm force-pushed the awad/tunnel-astro branch 2 times, most recently from 3dfbedc to e9cafef Compare October 15, 2026 16:38
@logaretm

logaretm commented Oct 15, 2026

Copy link
Copy Markdown
Member Author

bugbot run

cursor[bot]
cursor Bot reviewed Oct 15, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Comment thread packages/astro/src/server/middleware.ts
@logaretm

logaretm commented Oct 16, 2026

Copy link
Copy Markdown
Member Author

bugbot run

cursor[bot]
cursor Bot reviewed Oct 16, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 40a29bc. Configure here.

@logaretm
logaretm force-pushed the awad/tunnel-astro branch 2 times, most recently from 3c79c4e to cd1c651 Compare October 16, 2026 14:00
@semgrep-code-getsentry

semgrep-code-getsentry Bot commented Oct 19, 2026

Copy link
Copy Markdown

Semgrep found 1 ssc-042b939e-2ff9-2650-02f7-3f2c930472e6 finding:

  • packages/nuxt/src/runtime/plugins/tunnel-legacy.server.ts

🟠 High severity issue identified in your code:

Risk: Affected versions of h3 are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The readRawBody function in h3 performs a strict, case-sensitive check for "chunked" in the Transfer-Encoding header. If an attacker sends a mixed-case value (e.g. "Transfer-Encoding: ChuNked") and no Content-Length, h3 will assume an empty body, immediately process the request, and leave the real payload data on the socket. When h3 is deployed behind a Layer 4 proxy (such as AWS NLB or raw TCP proxies that don't normalize headers), this enables a classic TE.TE HTTP request smuggling attack—allowing an attacker to bypass WAFs or desynchronize and poison other users' connections.

Fix: Upgrade this library to at least version 1.15.5 at sentry-javascript/yarn.lock:16852.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2737, GHSA-mp2g-9vg9-f4cg, CVE-2026-23527

@logaretm
feat(astro): Serve the managed tunnel from the Sentry middleware
00ea304 
The Sentry middleware runs first and answers tunnel requests. The integration
hands Astro's `base` and `trailingSlash: 'always'` to both SDKs, so `tunnel: true`
follows Astro's routing without repeating them.
@logaretm
fix(astro): Run the server init before the middleware so the tunnel w…
86357db 
…orks on a cold server
@logaretm
fix(astro): Serve a relative tunnel path under the base path too
89dfb26
@logaretm
test(astro): Check the managed tunnel under astro dev too
30d7c30
@logaretm
revert(astro): Load the server init from SSR pages only, as on develop
9c46fc7 
This reverts commit 6647a68. The middleware module ran the inline default init a second time, and running the init before a cold non-page request is a gap develop has for every server request, not one the tunnel adds.
@logaretm
ref(astro): Import the tunnel handler from @sentry/core/server
2970e33
@logaretm
fix(astro): Serve the managed tunnel under base on Cloudflare Workers
740bba2 
The server's tunnel base path only reached `@sentry/astro`'s own server init. On Workers the client comes from
`@sentry/cloudflare`, so the browser posted under `base` and got a 404. The server side of the tunnel options
module now goes through core's managed tunnel defaults, and the Worker entry imports it first.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Astro managed tunnel

1 participant

@logaretm