feat(core): Add managed tunnel helpers that derive the tunnel path from the DSN by logaretm · Pull Request #25199 · getsentry/sentry-javascript

feat(core): Add managed tunnel helpers that derive the tunnel path from the DSN

logaretm

committed

1761f88

ref(core): Pass the whole request to the tunnel matcher and expose `getTunnelPaths`

logaretm

committed

4d25222

perf(core): Cache the tunnel path per DSN

logaretm

committed

0663722

feat(core): Serve a fixed managed tunnel path from a relative `tunnel` on the server

logaretm

committed

2571164

feat(core): Drop the server spans of managed tunnel requests

logaretm

committed

bdd9dd3

fix(core): Skip fetch instrumentation while tracing is suppressed

logaretm

committed

0ca4167

feat(core): Check the tunnel DSN before reading the envelope body

logaretm

committed

2f04c1e

fix(core): Cancel the body of a rejected tunnel request

logaretm

committed

eb3b484

feat(core): Forward the client IP of tunnel requests to Sentry

logaretm

committed

da47f3b

fix(core): Match a fixed tunnel path that ends with a slash

logaretm

committed

5ce1dad

fix(core): Only answer the managed tunnel under its base path

logaretm

committed

53aa687

feat(core): Always accept the server's own DSN in the managed tunnel

logaretm

committed

88fdc70

feat(core): Add `applyTunnelDefaults` so framework SDKs fill in the base path the same way

logaretm

committed

2f1126b

feat(core): Add `setManagedTunnelBasePath` for servers that learn the base path after `init`

logaretm

committed

0620c82

feat(core): Mark the tunnel handler's responses so the browser can tell them apart

logaretm

committed

52e8577

fix(core): Normalize tunnel base paths with one util that doesn't backtrack

logaretm

committed

dcd5dbf

fix(core): Leave a fixed tunnel path to the app when there is no DSN to forward to

logaretm

committed

0052d4c

fix(core): Don't add the base path again to a tunnel path that already starts with it

logaretm

committed

e98405d

fix(core): Don't report a client that drops the tunnel request as an error

logaretm

committed

7e7e5fb

fix(core): Also drop tunnel spans that only carry `http.url`, like SvelteKit's root span

logaretm

committed

077557b

feat(core): Add enableManagedTunnel for framework options that enable the tunnel outside init

logaretm

committed

4c6211b

ref(core): Settle a server client's managed tunnel in one place, from init or framework defaults

logaretm

committed

81812da

test(nextjs): Read back the streamed body in the tunnel route test

logaretm

committed

5c90301

ref(core): Compute the managed tunnel paths once per server client

logaretm

committed

54472c7

ref(core): Resolve the managed tunnel's DSNs once per server client

logaretm

committed

2a51cae

fix(core): Don't forward the tunnel request's Content-Length with the streamed body

logaretm

committed

466d219

ref(core): Keep the served tunnel paths and DSNs out of ClientOptions

logaretm

committed

6443fbb

ref(core): Trim the managed tunnel comments

logaretm

committed

5fc8121

feat(core): Keep the tunnel body size checks with the streamed forward

logaretm

committed

baf80cd

ref(core): Rename withPathBelowBasePath to stripBasePathFromTunnelPath

logaretm

committed

f97d8a2

ref(core): Normalize the default base path in applyTunnelDefaults and ignore a root one

logaretm

committed

d40133d

fix(core): Normalize allowedDsns like the envelope header's DSN, so one written with a secret key still matches

logaretm

committed

5c0e6ff

Navigation Menu

Repository navigation

feat(core): Add managed tunnel helpers that derive the tunnel path from the DSN - #25199

feat(core): Add managed tunnel helpers that derive the tunnel path from the DSN#25199
logaretm wants to merge 32 commits into
developfrom
awad/tunnel-core-dsn-path

Commits on Oct 19, 2026

feat(core): Add managed tunnel helpers that derive the tunnel path from the DSN

ref(core): Pass the whole request to the tunnel matcher and expose `getTunnelPaths`

perf(core): Cache the tunnel path per DSN

feat(core): Serve a fixed managed tunnel path from a relative `tunnel` on the server

feat(core): Drop the server spans of managed tunnel requests

fix(core): Skip fetch instrumentation while tracing is suppressed

feat(core): Check the tunnel DSN before reading the envelope body

fix(core): Cancel the body of a rejected tunnel request

feat(core): Forward the client IP of tunnel requests to Sentry

fix(core): Match a fixed tunnel path that ends with a slash

fix(core): Only answer the managed tunnel under its base path

feat(core): Always accept the server's own DSN in the managed tunnel

feat(core): Add `applyTunnelDefaults` so framework SDKs fill in the base path the same way

feat(core): Add `setManagedTunnelBasePath` for servers that learn the base path after `init`

feat(core): Mark the tunnel handler's responses so the browser can tell them apart

fix(core): Normalize tunnel base paths with one util that doesn't backtrack

fix(core): Leave a fixed tunnel path to the app when there is no DSN to forward to

fix(core): Don't add the base path again to a tunnel path that already starts with it

fix(core): Don't report a client that drops the tunnel request as an error

fix(core): Also drop tunnel spans that only carry `http.url`, like SvelteKit's root span

feat(core): Add enableManagedTunnel for framework options that enable the tunnel outside init

ref(core): Settle a server client's managed tunnel in one place, from init or framework defaults

test(nextjs): Read back the streamed body in the tunnel route test

ref(core): Compute the managed tunnel paths once per server client

ref(core): Resolve the managed tunnel's DSNs once per server client

fix(core): Don't forward the tunnel request's Content-Length with the streamed body

ref(core): Keep the served tunnel paths and DSNs out of ClientOptions

ref(core): Trim the managed tunnel comments

feat(core): Keep the tunnel body size checks with the streamed forward

ref(core): Rename withPathBelowBasePath to stripBasePathFromTunnelPath

ref(core): Normalize the default base path in applyTunnelDefaults and ignore a root one

fix(core): Normalize allowedDsns like the envelope header's DSN, so one written with a secret key still matches