{"version":3,"file":"http.js","sources":["../../../src/integrations/http.ts"],"sourcesContent":["import type { RequestOptions } from 'node:http';\nimport type { HttpClientRequest, HttpIncomingMessage, HttpServerResponse, Span } from '@sentry/core';\nimport {\n  defineIntegration,\n  hasSpansEnabled,\n  SEMANTIC_ATTRIBUTE_URL_FULL,\n  stripDataUrlContent,\n  getRequestUrlFromClientRequest,\n} from '@sentry/core';\nimport type {\n  NodeClient,\n  SentryHttpInstrumentationOptions,\n  HttpServerIntegrationOptions,\n  HttpServerSpansIntegrationOptions,\n} from '@sentry/node-core';\nimport {\n  generateInstrumentOnce,\n  httpServerIntegration,\n  httpServerSpansIntegration,\n  SentryHttpInstrumentation,\n} from '@sentry/node-core';\n\nconst INTEGRATION_NAME = 'Http';\n\n// TODO(v11): Consolidate all the various HTTP integration options into one,\n// and deprecate the duplicated and aliased options.\ninterface HttpOptions {\n  /**\n   * Whether breadcrumbs should be recorded for outgoing requests.\n   * Defaults to true\n   */\n  breadcrumbs?: boolean;\n\n  /**\n   * If set to false, do not emit any spans.\n   * This will ensure that the default HttpInstrumentation from OpenTelemetry is not setup,\n   * only the Sentry-specific instrumentation for request isolation is applied.\n   *\n   * If `skipOpenTelemetrySetup: true` is configured, this defaults to `false`, otherwise it defaults to `true`.\n   */\n  spans?: boolean;\n\n  /**\n   * Whether the integration should create [Sessions](https://docs.sentry.io/product/releases/health/#sessions) for incoming requests to track the health and crash-free rate of your releases in Sentry.\n   * Read more about Release Health: https://docs.sentry.io/product/releases/health/\n   *\n   * Defaults to `true`.\n   */\n  trackIncomingRequestsAsSessions?: boolean;\n\n  /**\n   * Number of milliseconds until sessions tracked with `trackIncomingRequestsAsSessions` will be flushed as a session aggregate.\n   *\n   * Defaults to `60000` (60s).\n   */\n  sessionFlushingDelayMS?: number;\n\n  /**\n   * Whether to inject trace propagation headers (sentry-trace, baggage, traceparent) into outgoing HTTP requests.\n   *\n   * When set to `false`, Sentry will not inject any trace propagation headers, but will still create breadcrumbs\n   * (if `breadcrumbs` is enabled). This is useful when `skipOpenTelemetrySetup: true` is configured and you want\n   * to avoid duplicate trace headers being injected by both Sentry and OpenTelemetry's HttpInstrumentation.\n   *\n   * @default `true`\n   */\n  tracePropagation?: boolean;\n\n  /**\n   * Do not capture spans or breadcrumbs for outgoing HTTP requests to URLs where the given callback returns `true`.\n   * This controls both span & breadcrumb creation - spans will be non recording if tracing is disabled.\n   *\n   * The `url` param contains the entire URL, including query string (if any), protocol, host, etc. of the outgoing request.\n   * For example: `'https://someService.com/users/details?id=123'`\n   *\n   * The `request` param contains the original {@type RequestOptions} object used to make the outgoing request.\n   * You can use it to filter on additional properties like method, headers, etc.\n   */\n  ignoreOutgoingRequests?: (url: string, request: RequestOptions) => boolean;\n\n  /**\n   * Do not capture spans for incoming HTTP requests to URLs where the given callback returns `true`.\n   * Spans will be non recording if tracing is disabled.\n   *\n   * The `urlPath` param consists of the URL path and query string (if any) of the incoming request.\n   * For example: `'/users/details?id=123'`\n   *\n   * The `request` param contains the original {@type IncomingMessage} object of the incoming request.\n   * You can use it to filter on additional properties like method, headers, etc.\n   */\n  ignoreIncomingRequests?: (urlPath: string, request: HttpIncomingMessage) => boolean;\n\n  /**\n   * A hook that can be used to mutate the span for incoming requests.\n   * This is triggered after the span is created, but before it is recorded.\n   */\n  incomingRequestSpanHook?: (span: Span, request: HttpIncomingMessage, response: HttpServerResponse) => void;\n\n  /**\n   * Whether to automatically ignore common static asset requests like favicon.ico, robots.txt, etc.\n   * This helps reduce noise in your transactions.\n   *\n   * @default `true`\n   */\n  ignoreStaticAssets?: boolean;\n\n  /**\n   * Do not capture spans for incoming HTTP requests with the given status codes.\n   * By default, spans with some 3xx and 4xx status codes are ignored (see @default).\n   * Expects an array of status codes or a range of status codes, e.g. [[300,399], 404] would ignore 3xx and 404 status codes.\n   *\n   * @default `[[401, 404], [301, 303], [305, 399]]`\n   */\n  dropSpansForIncomingRequestStatusCodes?: (number | [number, number])[];\n\n  /**\n   * Do not capture the request body for incoming HTTP requests to URLs where the given callback returns `true`.\n   * This can be useful for long running requests where the body is not needed and we want to avoid capturing it.\n   *\n   * @param url Contains the entire URL, including query string (if any), protocol, host, etc. of the incoming request.\n   * @param request Contains the {@type RequestOptions} object used to make the incoming request.\n   */\n  ignoreIncomingRequestBody?: (url: string, request: RequestOptions) => boolean;\n\n  /**\n   * Controls the maximum size of incoming HTTP request bodies attached to events.\n   *\n   * Available options:\n   * - 'none': No request bodies will be attached\n   * - 'small': Request bodies up to 1,000 bytes will be attached\n   * - 'medium': Request bodies up to 10,000 bytes will be attached (default)\n   * - 'always': Request bodies will always be attached\n   *\n   * Note that even with 'always' setting, bodies exceeding 1MB will never be attached\n   * for performance and security reasons.\n   *\n   * @default 'medium'\n   */\n  maxIncomingRequestBodySize?: 'none' | 'small' | 'medium' | 'always';\n\n  /**\n   * If true, do not generate spans for incoming requests at all.\n   * This is used by Remix to avoid generating spans for incoming requests, as it generates its own spans.\n   */\n  disableIncomingRequestSpans?: boolean;\n\n  /**\n   * Additional instrumentation options that are passed to the underlying HttpInstrumentation.\n   */\n  instrumentation?: {\n    requestHook?: (span: Span, req: HttpIncomingMessage | HttpClientRequest) => void;\n    responseHook?: (span: Span, response: HttpIncomingMessage | HttpServerResponse) => void;\n    applyCustomAttributesOnSpan?: (\n      span: Span,\n      request: HttpIncomingMessage | HttpClientRequest,\n      response: HttpIncomingMessage | HttpServerResponse,\n    ) => void;\n  };\n}\n\nexport const instrumentSentryHttp = generateInstrumentOnce<SentryHttpInstrumentationOptions>(\n  `${INTEGRATION_NAME}.sentry`,\n  options => {\n    return new SentryHttpInstrumentation(options);\n  },\n);\n\n/**\n * The http integration instruments Node's internal http and https modules.\n * It creates breadcrumbs and spans for outgoing HTTP requests which will be attached to the currently active span.\n */\nexport const httpIntegration = defineIntegration((options: HttpOptions = {}) => {\n  const spans = options.spans ?? true;\n  const disableIncomingRequestSpans = options.disableIncomingRequestSpans;\n  const enableServerSpans = spans && !disableIncomingRequestSpans;\n\n  const serverOptions = {\n    sessions: options.trackIncomingRequestsAsSessions,\n    sessionFlushingDelayMS: options.sessionFlushingDelayMS,\n    ignoreRequestBody: options.ignoreIncomingRequestBody,\n    maxRequestBodySize: options.maxIncomingRequestBodySize,\n  } satisfies HttpServerIntegrationOptions;\n\n  const serverSpansOptions: HttpServerSpansIntegrationOptions = {\n    ignoreIncomingRequests: options.ignoreIncomingRequests,\n    ignoreStaticAssets: options.ignoreStaticAssets,\n    ignoreStatusCodes: options.dropSpansForIncomingRequestStatusCodes,\n    instrumentation: options.instrumentation,\n    onSpanCreated: options.incomingRequestSpanHook,\n  };\n\n  const server = httpServerIntegration(serverOptions);\n  const serverSpans = httpServerSpansIntegration(serverSpansOptions);\n\n  return {\n    name: INTEGRATION_NAME,\n    setup(client: NodeClient) {\n      const clientOptions = client.getOptions();\n\n      if (enableServerSpans && hasSpansEnabled(clientOptions)) {\n        serverSpans.setup(client);\n      }\n    },\n    setupOnce() {\n      server.setupOnce();\n\n      const sentryHttpInstrumentationOptions: SentryHttpInstrumentationOptions = {\n        breadcrumbs: options.breadcrumbs,\n        spans,\n        propagateTraceInOutgoingRequests: options.tracePropagation ?? true,\n        createSpansForOutgoingRequests: spans,\n        ignoreOutgoingRequests: options.ignoreOutgoingRequests,\n        outgoingRequestHook: (span: Span, request: HttpClientRequest) => {\n          // Sanitize data URLs to prevent long base64 strings in span attributes\n          const url = getRequestUrlFromClientRequest(request);\n          if (url.startsWith('data:')) {\n            const sanitizedUrl = stripDataUrlContent(url);\n            // TODO(v11): Update these to the Sentry semantic attributes.\n            // https://getsentry.github.io/sentry-conventions/attributes/\n            span.setAttribute('http.url', sanitizedUrl);\n            span.setAttribute(SEMANTIC_ATTRIBUTE_URL_FULL, sanitizedUrl);\n            span.updateName(`${request.method || 'GET'} ${sanitizedUrl}`);\n          }\n          options.instrumentation?.requestHook?.(span, request);\n        },\n        outgoingResponseHook: options.instrumentation?.responseHook,\n        outgoingRequestApplyCustomAttributes: options.instrumentation?.applyCustomAttributesOnSpan,\n      };\n\n      // This is Sentry-specific instrumentation for outgoing request\n      // breadcrumbs & trace propagation. It uses the diagnostic channels on\n      // node versions that support it, falling back to monkey-patching when\n      // needed.\n      instrumentSentryHttp(sentryHttpInstrumentationOptions);\n    },\n    processEvent(event) {\n      // Always run this, even if spans are disabled\n      // The reason being that e.g. the remix integration disables span\n      // creation here but still wants to use the ignore status codes option\n      return serverSpans.processEvent(event);\n    },\n  };\n});\n"],"names":[],"mappings":";;;AAsBA,MAAM,gBAAA,GAAmB,MAAA;AA0IlB,MAAM,oBAAA,GAAuB,sBAAA;AAAA,EAClC,GAAG,gBAAgB,CAAA,OAAA,CAAA;AAAA,EACnB,CAAA,OAAA,KAAW;AACT,IAAA,OAAO,IAAI,0BAA0B,OAAO,CAAA;AAAA,EAC9C;AACF;AAMO,MAAM,eAAA,GAAkB,iBAAA,CAAkB,CAAC,OAAA,GAAuB,EAAC,KAAM;AAC9E,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,IAAA;AAC/B,EAAA,MAAM,8BAA8B,OAAA,CAAQ,2BAAA;AAC5C,EAAA,MAAM,iBAAA,GAAoB,SAAS,CAAC,2BAAA;AAEpC,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,UAAU,OAAA,CAAQ,+BAAA;AAAA,IAClB,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,IAChC,mBAAmB,OAAA,CAAQ,yBAAA;AAAA,IAC3B,oBAAoB,OAAA,CAAQ;AAAA,GAC9B;AAEA,EAAA,MAAM,kBAAA,GAAwD;AAAA,IAC5D,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,IAChC,oBAAoB,OAAA,CAAQ,kBAAA;AAAA,IAC5B,mBAAmB,OAAA,CAAQ,sCAAA;AAAA,IAC3B,iBAAiB,OAAA,CAAQ,eAAA;AAAA,IACzB,eAAe,OAAA,CAAQ;AAAA,GACzB;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAsB,aAAa,CAAA;AAClD,EAAA,MAAM,WAAA,GAAc,2BAA2B,kBAAkB,CAAA;AAEjE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,gBAAA;AAAA,IACN,MAAM,MAAA,EAAoB;AACxB,MAAA,MAAM,aAAA,GAAgB,OAAO,UAAA,EAAW;AAExC,MAAA,IAAI,iBAAA,IAAqB,eAAA,CAAgB,aAAa,CAAA,EAAG;AACvD,QAAA,WAAA,CAAY,MAAM,MAAM,CAAA;AAAA,MAC1B;AAAA,IACF,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,MAAA,CAAO,SAAA,EAAU;AAEjB,MAAA,MAAM,gCAAA,GAAqE;AAAA,QACzE,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,KAAA;AAAA,QACA,gCAAA,EAAkC,QAAQ,gBAAA,IAAoB,IAAA;AAAA,QAC9D,8BAAA,EAAgC,KAAA;AAAA,QAChC,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,QAChC,mBAAA,EAAqB,CAAC,IAAA,EAAY,OAAA,KAA+B;AAE/D,UAAA,MAAM,GAAA,GAAM,+BAA+B,OAAO,CAAA;AAClD,UAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,YAAA,MAAM,YAAA,GAAe,oBAAoB,GAAG,CAAA;AAG5C,YAAA,IAAA,CAAK,YAAA,CAAa,YAAY,YAAY,CAAA;AAC1C,YAAA,IAAA,CAAK,YAAA,CAAa,6BAA6B,YAAY,CAAA;AAC3D,YAAA,IAAA,CAAK,WAAW,CAAA,EAAG,OAAA,CAAQ,UAAU,KAAK,CAAA,CAAA,EAAI,YAAY,CAAA,CAAE,CAAA;AAAA,UAC9D;AACA,UAAA,OAAA,CAAQ,eAAA,EAAiB,WAAA,GAAc,IAAA,EAAM,OAAO,CAAA;AAAA,QACtD,CAAA;AAAA,QACA,oBAAA,EAAsB,QAAQ,eAAA,EAAiB,YAAA;AAAA,QAC/C,oCAAA,EAAsC,QAAQ,eAAA,EAAiB;AAAA,OACjE;AAMA,MAAA,oBAAA,CAAqB,gCAAgC,CAAA;AAAA,IACvD,CAAA;AAAA,IACA,aAAa,KAAA,EAAO;AAIlB,MAAA,OAAO,WAAA,CAAY,aAAa,KAAK,CAAA;AAAA,IACvC;AAAA,GACF;AACF,CAAC;;;;"}