Skip to content

fix(utils): Streamline IP capturing on incoming requests #13272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 8, 2024

Conversation

mydea
Copy link
Member

@mydea mydea commented Aug 8, 2024

This PR does three things:

  1. It ensures we infer the IP (in RequestData integration) from IP-related headers, if available.
  2. It ensures we do not send these headers if IP capturing is not enabled (which is the default)
  3. It removes the custom handling we had for this in remix, as this should now just be handled generally

Closes #13260

@mydea mydea self-assigned this Aug 8, 2024
Copy link
Contributor

github-actions bot commented Aug 8, 2024

size-limit report 📦

Path Size
@sentry/browser 22.47 KB (0%)
@sentry/browser (incl. Tracing) 34.26 KB (0%)
@sentry/browser (incl. Tracing, Replay) 70.31 KB (0%)
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 63.64 KB (0%)
@sentry/browser (incl. Tracing, Replay with Canvas) 74.71 KB (0%)
@sentry/browser (incl. Tracing, Replay, Feedback) 87.32 KB (0%)
@sentry/browser (incl. Tracing, Replay, Feedback, metrics) 89.16 KB (0%)
@sentry/browser (incl. metrics) 26.77 KB (0%)
@sentry/browser (incl. Feedback) 39.42 KB (0%)
@sentry/browser (incl. sendFeedback) 27.09 KB (0%)
@sentry/browser (incl. FeedbackAsync) 31.75 KB (0%)
@sentry/react 25.24 KB (0%)
@sentry/react (incl. Tracing) 37.25 KB (0%)
@sentry/vue 26.62 KB (0%)
@sentry/vue (incl. Tracing) 36.1 KB (0%)
@sentry/svelte 22.61 KB (0%)
CDN Bundle 23.69 KB (0%)
CDN Bundle (incl. Tracing) 35.93 KB (0%)
CDN Bundle (incl. Tracing, Replay) 70.36 KB (0%)
CDN Bundle (incl. Tracing, Replay, Feedback) 75.61 KB (0%)
CDN Bundle - uncompressed 69.52 KB (0%)
CDN Bundle (incl. Tracing) - uncompressed 106.43 KB (0%)
CDN Bundle (incl. Tracing, Replay) - uncompressed 218.27 KB (0%)
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 231.16 KB (0%)
@sentry/nextjs (client) 37.1 KB (0%)
@sentry/sveltekit (client) 34.81 KB (0%)
@sentry/node 115.27 KB (+0.37% 🔺)
@sentry/node - without tracing 89.77 KB (+0.5% 🔺)
@sentry/aws-serverless 98.94 KB (+0.44% 🔺)

@lforst
Copy link
Contributor

lforst commented Aug 8, 2024

It ensures we do not send these headers if IP capturing is not enabled (which is the default)

I don't like this change a ton because a) it is a bit intransparent to debug b) it is behaviourally breaking if people set ip: false, so that sentry picks up the headers from let's say x-Real-Ip.

@mydea
Copy link
Member Author

mydea commented Aug 8, 2024

I don't like this change a ton because a) it is a bit intransparent to debug b) it is behaviourally breaking if people set ip: false, so that sentry picks up the headers from let's say x-Real-Ip.

I would say that it was a bug that we did not do that before. If I do not enable IP capturing, we should not capture IPs, and it was not a conscious choice to do that (and it's also inconsistent with other platforms, e.g. in python we do what this PR introduces). We do the same for the cookie header, I do not think it is confusing that there is no cookie header if you do not enable cookie capturing, and the same applies here IMHO!

If you used to rely on these headers, and suddenly they are gone, and you notice that, you can properly opt-in to IP capturing to get your desired outcome again!

const extractedRequestData = Array.isArray(include.request)
? extractRequestData(req, { include: include.request })
: extractRequestData(req);
const includeRequest = Array.isArray(include.request) ? [...include.request] : [...DEFAULT_REQUEST_INCLUDES];
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

q: do we need to spread include.request here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, because we mutate this below possibly (adding the ip), and don't want to mutate what the user passes in! (ran into this in a test...)

@mydea mydea merged commit adf7b40 into develop Aug 8, 2024
123 checks passed
@mydea mydea deleted the fn/better-node-ip-handling branch August 8, 2024 13:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve handling of IP addresses
6 participants