feat(nextjs): Serve the tunnel from the app with a DSN-derived path by logaretm · Pull Request #25424 · getsentry/sentry-javascript

logaretm · 2026-10-15T20:01:15Z

tunnelRoute rewrote envelopes straight to sentry.io, which leaked the user's cookies and only worked for SaaS DSNs, fixed by answering it from a generated app route on the DSN-derived path.

The unit tests cover the rewrites, the injected options and the route file generation, and e2e variants check the App and Pages routers on Turbopack and webpack.

closes #25466

github-actions · 2026-10-15T20:08:04Z

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	31.03 kB	+3.87%	+1.16 kB 🔺
@sentry/browser - with treeshaking flags	28.82 kB	+2.87%	+803 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing	28.72 kB	+2.86%	+798 B 🔺
@sentry/browser (incl. Tracing)	53.24 kB	+2.26%	+1.17 kB 🔺
@sentry/browser (incl. Tracing + Span Streaming)	53.24 kB	+2.24%	+1.17 kB 🔺
@sentry/browser (incl. Tracing, Profiling)	56.24 kB	+2.24%	+1.23 kB 🔺
@sentry/browser (incl. Tracing, Replay)	92.99 kB	+1.28%	+1.17 kB 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	81.48 kB	+1%	+799 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	97.74 kB	+1.24%	+1.19 kB 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	110.67 kB	+1.09%	+1.19 kB 🔺
@sentry/browser (incl. Feedback)	48.6 kB	+2.55%	+1.21 kB 🔺
@sentry/browser (incl. sendFeedback)	36.12 kB	+3.37%	+1.18 kB 🔺
@sentry/browser (incl. FeedbackAsync)	41.25 kB	+3%	+1.2 kB 🔺
@sentry/browser (incl. Metrics)	32.03 kB	+3.65%	+1.13 kB 🔺
@sentry/browser (incl. Logs)	32.32 kB	+3.65%	+1.14 kB 🔺
@sentry/browser (incl. Metrics & Logs)	33.01 kB	+3.78%	+1.2 kB 🔺
@sentry/react	32.84 kB	+3.58%	+1.13 kB 🔺
@sentry/react (incl. Tracing)	55.52 kB	+2.08%	+1.13 kB 🔺
@sentry/vue	39.21 kB	+3.09%	+1.17 kB 🔺
@sentry/vue (incl. Tracing)	56.25 kB	+2.26%	+1.24 kB 🔺
@sentry/svelte	31.06 kB	+3.88%	+1.16 kB 🔺
@sentry/remix (Remix 3 client bundle)	58.28 kB	+2.11%	+1.2 kB 🔺
CDN Bundle	32.36 kB	+2.27%	+716 B 🔺
CDN Bundle (incl. Tracing)	53.3 kB	+1.38%	+723 B 🔺
CDN Bundle (incl. Logs, Metrics)	34.55 kB	+2.13%	+718 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	55.25 kB	+1.34%	+728 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)	75.52 kB	+1.01%	+751 B 🔺
CDN Bundle (incl. Tracing, Replay)	90.97 kB	+0.8%	+717 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	92.96 kB	+0.86%	+785 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	97.14 kB	+0.77%	+737 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	99.14 kB	+0.81%	+792 B 🔺
CDN Bundle - uncompressed	95.04 kB	+2%	+1.86 kB 🔺
CDN Bundle (incl. Tracing) - uncompressed	157.88 kB	+1.19%	+1.85 kB 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed	101.58 kB	+1.87%	+1.86 kB 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	163.84 kB	+1.15%	+1.85 kB 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	231.62 kB	+0.82%	+1.86 kB 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	278.05 kB	+0.67%	+1.85 kB 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	283.99 kB	+0.66%	+1.85 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	291.75 kB	+0.64%	+1.85 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	297.69 kB	+0.63%	+1.85 kB 🔺
@sentry/nextjs (client)	57.78 kB	+1.74%	+985 B 🔺
@sentry/sveltekit (client)	53.67 kB	+2.34%	+1.23 kB 🔺
@sentry/core/server	41.85 kB	+1.78%	+730 B 🔺
@sentry/core/browser	13.81 kB	-	-
@sentry/node	153.84 kB	+0.5%	+757 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	84.04 kB	-	-
@sentry/node - without tracing	95.58 kB	+0.75%	+707 B 🔺
@sentry/node - without channel injection	131.89 kB	+0.58%	+748 B 🔺
@sentry/aws-serverless	103.84 kB	+0.79%	+805 B 🔺
@sentry/cloudflare (withSentry) - minified	212.53 kB	+0.92%	+1.93 kB 🔺
@sentry/cloudflare (withSentry)	526.33 kB	+0.73%	+3.8 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified	231.2 kB	+1.29%	+2.92 kB 🔺

View base workflow run

logaretm · 2026-10-15T21:56:11Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T02:14:53Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T02:25:59Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T04:22:22Z

bugbot run

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5472088. Configure here.}

cursor · 2026-10-16T04:28:30Z

+    basePath: userNextConfig.basePath ?? '',
+    ...(path && { path }),
+    ...(allowedDsns && { allowedDsns }),
+  };


Tunnel ignores Next.js trailingSlash

Medium Severity

getManagedTunnelOptions copies basePath from the Next.js config but not trailingSlash, so the browser posts to the slashless DSN path. With trailingSlash: true, Next.js 308s that POST before beforeFiles rewrites, and the DSN rewrite source also omits the optional trailing slash that the fixed-path rewrite includes. Unload-time keepalive fetches often will not follow that redirect, so events never reach the tunnel.

Additional Locations (1)

packages/nextjs/src/config/withSentryConfig/tunnel.ts#L43-L48

^{Reviewed by Cursor Bugbot for commit 5472088. Configure here.}

…l span test

…ot has pages

… tunnel test

…ope content type

…that differs from the server's

…el through

logaretm added this pull request to stack #25201 October 15, 2026 20:01

sentry-warden Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread packages/nextjs/src/config/types.ts Outdated

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread dev-packages/e2e-tests/test-applications/nextjs-16-tunnel/tests/tunnel-dsn-path.test.ts

logaretm force-pushed the awad/tunnel-nextjs branch from 0bd8edd to a0d5655 Compare October 16, 2026 01:51

cursor Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread packages/nextjs/src/config/withSentryConfig/tunnel.ts

Comment thread dev-packages/e2e-tests/test-applications/nextjs-pages-dir/tests/tunnel-dsn-path.test.ts

logaretm force-pushed the awad/tunnel-nextjs branch from a0d5655 to bff33ce Compare October 16, 2026 02:25

cursor Bot reviewed Oct 16, 2026

View reviewed changes

logaretm force-pushed the awad/tunnel-nextjs branch from bff33ce to 61392db Compare October 16, 2026 03:32

logaretm force-pushed the awad/tunnel-nextjs branch from 5472088 to ae51678 Compare October 16, 2026 04:23

cursor Bot reviewed Oct 16, 2026

View reviewed changes

logaretm force-pushed the awad/tunnel-nextjs branch from ae51678 to 9c50125 Compare October 16, 2026 04:48

logaretm force-pushed the awad/tunnel-nextjs branch from 9c50125 to e94f25d Compare October 16, 2026 14:00

logaretm force-pushed the awad/tunnel-nextjs branch from e94f25d to efc9b07 Compare October 16, 2026 14:37

logaretm force-pushed the awad/tunnel-nextjs branch from efc9b07 to 2e8e2b3 Compare October 16, 2026 16:15

logaretm mentioned this pull request Oct 16, 2026

Next.js managed tunnel on the tunnel route handler #25466

Open

logaretm force-pushed the awad/tunnel-nextjs branch from 2e8e2b3 to 2c6c3d8 Compare October 16, 2026 17:56

logaretm force-pushed the awad/tunnel-nextjs branch from 2c6c3d8 to 75baeeb Compare October 16, 2026 20:56

logaretm added 9 commits October 16, 2026 17:01

feat(nextjs): Serve the tunnel from the app with a DSN-derived path

8f944c8

fix(nextjs): Read the injected tunnel options when the client has none

988fb97

test(nextjs): Wait for a later span instead of a timeout in the tunne…

f10a7fe

…l span test

fix(nextjs): Write the tunnel route into the root app dir when the ro…

ed111d1

…ot has pages

test(nextjs): Wait for a later span instead of a timeout in the pages…

aa83fbf

… tunnel test

fix(nextjs): Point middleware at the tunnel path instead of the envel…

11b9c12

…ope content type

feat(nextjs): Accept allowed DSNs in tunnelRoute for a browser DSN …

5658032

…that differs from the server's

feat(nextjs): Export isTunnelRequest so middleware can let the tunn…

30bf482

…el through

fix(nextjs): Serve the server's own DSN path alongside allowedDsns

f6df1c6

logaretm force-pushed the awad/tunnel-nextjs branch from 75baeeb to f6df1c6 Compare October 16, 2026 21:02

Conversation

logaretm commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Uh oh!

logaretm commented Oct 15, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 16, 2026

Choose a reason for hiding this comment

Tunnel ignores Next.js trailingSlash

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

logaretm commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading