feat(nextjs): Serve the tunnel from the app with a DSN-derived path by logaretm · Pull Request #25424 · getsentry/sentry-javascript

logaretm · 2026-10-15T20:01:15Z

tunnelRoute rewrote envelopes straight to sentry.io, which leaked the user's cookies and only worked for SaaS DSNs, fixed by answering it from a generated app route on the DSN-derived path.

The unit tests cover the rewrites, the injected options and the route file generation, and e2e variants check the App and Pages routers on Turbopack and webpack.

closes #25466

github-actions · 2026-10-15T20:08:04Z

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	30.61 kB	+2.46%	+734 B 🔺
@sentry/browser - with treeshaking flags	28.57 kB	+1.96%	+548 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing	28.45 kB	+1.9%	+529 B 🔺
@sentry/browser (incl. Tracing)	52.84 kB	+1.49%	+773 B 🔺
@sentry/browser (incl. Tracing + Span Streaming)	52.86 kB	+1.51%	+786 B 🔺
@sentry/browser (incl. Tracing, Profiling)	55.83 kB	+1.49%	+816 B 🔺
@sentry/browser (incl. Tracing, Replay)	92.55 kB	+0.8%	+726 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	81.22 kB	+0.67%	+537 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	97.29 kB	+0.77%	+739 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	110.25 kB	+0.7%	+764 B 🔺
@sentry/browser (incl. Feedback)	48.19 kB	+1.68%	+793 B 🔺
@sentry/browser (incl. sendFeedback)	35.69 kB	+2.16%	+753 B 🔺
@sentry/browser (incl. FeedbackAsync)	40.82 kB	+1.94%	+776 B 🔺
@sentry/browser (incl. Metrics)	31.62 kB	+2.33%	+718 B 🔺
@sentry/browser (incl. Logs)	31.89 kB	+2.28%	+709 B 🔺
@sentry/browser (incl. Metrics & Logs)	32.56 kB	+2.37%	+752 B 🔺
@sentry/react	32.41 kB	+2.25%	+711 B 🔺
@sentry/react (incl. Tracing)	55.1 kB	+1.33%	+718 B 🔺
@sentry/vue	38.76 kB	+1.9%	+719 B 🔺
@sentry/vue (incl. Tracing)	55.79 kB	+1.42%	+781 B 🔺
@sentry/svelte	30.64 kB	+2.49%	+742 B 🔺
@sentry/remix (Remix 3 client bundle)	57.89 kB	+1.42%	+807 B 🔺
CDN Bundle	32.16 kB	+1.64%	+518 B 🔺
CDN Bundle (incl. Tracing)	53.11 kB	+1%	+524 B 🔺
CDN Bundle (incl. Logs, Metrics)	34.34 kB	+1.49%	+503 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	55.06 kB	+0.99%	+538 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)	75.31 kB	+0.73%	+545 B 🔺
CDN Bundle (incl. Tracing, Replay)	90.76 kB	+0.57%	+508 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	92.69 kB	+0.56%	+514 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	96.92 kB	+0.55%	+522 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	98.89 kB	+0.56%	+547 B 🔺
CDN Bundle - uncompressed	94.5 kB	+1.43%	+1.32 kB 🔺
CDN Bundle (incl. Tracing) - uncompressed	157.36 kB	+0.85%	+1.32 kB 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed	101.04 kB	+1.33%	+1.32 kB 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	163.31 kB	+0.82%	+1.32 kB 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	231.08 kB	+0.58%	+1.32 kB 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	277.52 kB	+0.48%	+1.32 kB 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	283.46 kB	+0.47%	+1.32 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	291.23 kB	+0.46%	+1.32 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	297.15 kB	+0.45%	+1.32 kB 🔺
@sentry/nextjs (client)	57.35 kB	+0.98%	+556 B 🔺
@sentry/sveltekit (client)	53.31 kB	+1.64%	+859 B 🔺
@sentry/core/server	42.92 kB	+4.39%	+1.8 kB 🔺
@sentry/core/browser	13.81 kB	-	-
@sentry/node	153.75 kB	+0.44%	+668 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	84.04 kB	-	-
@sentry/node - without tracing	95.53 kB	+0.7%	+660 B 🔺
@sentry/node - without channel injection	131.78 kB	+0.49%	+636 B 🔺
@sentry/aws-serverless	103.77 kB	+0.71%	+730 B 🔺
@sentry/cloudflare (withSentry) - minified	212.6 kB	+0.96%	+2.01 kB 🔺
@sentry/cloudflare (withSentry)	527.41 kB	+0.94%	+4.89 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified	231.16 kB	+1.27%	+2.88 kB 🔺

View base workflow run

logaretm · 2026-10-15T21:56:11Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T02:14:53Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T02:25:59Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T04:22:22Z

bugbot run

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5472088. Configure here.}

cursor · 2026-10-16T04:28:30Z

+    basePath: userNextConfig.basePath ?? '',
+    ...(path && { path }),
+    ...(allowedDsns && { allowedDsns }),
+  };


Tunnel ignores Next.js trailingSlash

Medium Severity

getManagedTunnelOptions copies basePath from the Next.js config but not trailingSlash, so the browser posts to the slashless DSN path. With trailingSlash: true, Next.js 308s that POST before beforeFiles rewrites, and the DSN rewrite source also omits the optional trailing slash that the fixed-path rewrite includes. Unload-time keepalive fetches often will not follow that redirect, so events never reach the tunnel.

Additional Locations (1)

packages/nextjs/src/config/withSentryConfig/tunnel.ts#L43-L48

^{Reviewed by Cursor Bugbot for commit 5472088. Configure here.}

`withSentry` registers a Nitro v2 plugin that answers tunnel requests from the `request` hook, before the app's middleware. It goes through `server.plugins` because vinxi's dev server ignores plugins that Nitro modules add.

… server too

…s' mock requests work

…les don't run after it

…l span test

…ot has pages

… tunnel test

…ope content type

…that differs from the server's

…el through

logaretm added this pull request to stack #25201 October 15, 2026 20:01

sentry-warden Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread packages/nextjs/src/config/types.ts Outdated

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread dev-packages/e2e-tests/test-applications/nextjs-16-tunnel/tests/tunnel-dsn-path.test.ts

logaretm force-pushed the awad/tunnel-nextjs branch from 0bd8edd to a0d5655 Compare October 16, 2026 01:51

cursor Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread packages/nextjs/src/config/withSentryConfig/tunnel.ts

Comment thread dev-packages/e2e-tests/test-applications/nextjs-pages-dir/tests/tunnel-dsn-path.test.ts

logaretm force-pushed the awad/tunnel-nextjs branch from a0d5655 to bff33ce Compare October 16, 2026 02:25

cursor Bot reviewed Oct 16, 2026

View reviewed changes

logaretm force-pushed the awad/tunnel-nextjs branch from bff33ce to 61392db Compare October 16, 2026 03:32

logaretm force-pushed the awad/tunnel-nextjs branch from 5472088 to ae51678 Compare October 16, 2026 04:23

cursor Bot reviewed Oct 16, 2026

View reviewed changes

logaretm force-pushed the awad/tunnel-nextjs branch from ae51678 to 9c50125 Compare October 16, 2026 04:48

logaretm force-pushed the awad/tunnel-nextjs branch from 9c50125 to e94f25d Compare October 16, 2026 14:00

logaretm force-pushed the awad/tunnel-nextjs branch from e94f25d to efc9b07 Compare October 16, 2026 14:37

logaretm force-pushed the awad/tunnel-nextjs branch from efc9b07 to 2e8e2b3 Compare October 16, 2026 16:15

logaretm mentioned this pull request Oct 16, 2026

Next.js managed tunnel on the tunnel route handler #25466

Open

logaretm force-pushed the awad/tunnel-nextjs branch from 2e8e2b3 to 2c6c3d8 Compare October 16, 2026 17:56

logaretm added 19 commits October 19, 2026 00:57

feat(solidstart): Serve the managed tunnel on SolidStart v1

3591362

`withSentry` registers a Nitro v2 plugin that answers tunnel requests from the `request` hook, before the app's middleware. It goes through `server.plugins` because vinxi's dev server ignores plugins that Nitro modules add.

fix(solidstart): Serve the managed tunnel under server.baseURL

3ef6ec4

test(solidstart): Check the managed tunnel on SolidStart 2

d4c1fa8

test(solidstart): Check the managed tunnel under the SolidStart 2 dev…

60f8a5e

… server too

test(solidstart): Check the managed tunnel under vinxi dev too

9ca3f64

fix(solidstart): Normalize the tunnel base path with the core util

c101e43

fix(solidstart): Read the tunnel request with h3 so serverless preset…

deee419

…s' mock requests work

fix(solidstart): Serve the tunnel from the first h3 layer so route ru…

89f6ef6

…les don't run after it

ref(solidstart): Report the base path once with setManagedTunnelDefaults

d6f8d7d

feat(nextjs): Serve the tunnel from the app with a DSN-derived path

65160f0

fix(nextjs): Read the injected tunnel options when the client has none

e0d1111

test(nextjs): Wait for a later span instead of a timeout in the tunne…

9ad5e7d

…l span test

fix(nextjs): Write the tunnel route into the root app dir when the ro…

13bb279

…ot has pages

test(nextjs): Wait for a later span instead of a timeout in the pages…

43c4a5d

… tunnel test

fix(nextjs): Point middleware at the tunnel path instead of the envel…

bf77f91

…ope content type

feat(nextjs): Accept allowed DSNs in tunnelRoute for a browser DSN …

1efc017

…that differs from the server's

feat(nextjs): Export isTunnelRequest so middleware can let the tunn…

8cc5098

…el through

fix(nextjs): Serve the server's own DSN path alongside allowedDsns

b3177a2

ref(nextjs): Import the tunnel helpers from @sentry/core/server

5bc562c

logaretm force-pushed the awad/tunnel-nextjs branch from b98ec0a to 5bc562c Compare October 19, 2026 04:58

Conversation

logaretm commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Uh oh!

logaretm commented Oct 15, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 16, 2026

Choose a reason for hiding this comment

Tunnel ignores Next.js trailingSlash

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

logaretm commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading