[SvelteKit] intentional 4xx errors captured in prefetch

[hyunbinseo]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/sveltekit

SDK Version

10.60.0

Framework Version

No response

Link to Sentry event

No response

Reproduction Example/SDK Setup

https://github.com/hyunbinseo/svelte-kit-templates/tree/sentry-javascript-21775

// src/routes/protected/+page.server.ts
import { error } from '@sveltejs/kit';
export const load = () => error(403);

// src/hooks.client.ts
import * as Sentry from '@sentry/sveltekit';
export const handleError = Sentry.handleErrorWithSentry();

Trigger a client-side prefetch to /protected.

Steps to Reproduce

When a +page.server.ts throws error(403) and a client-side prefetch (e.g. hovering <a>) triggers it, handleErrorWithSentry() captures the error in Sentry despite the built-in is4xxError guard.

The resulting event is misleading: instead of a normal exception, Sentry reports a plain object capture.

Expected Result

No Sentry event — is4xxError should suppress it, as it does for full navigations.

Actual Result

A Sentry event is created with:

Type: Error
Value: Object captured as exception with keys: error, status, type

The error field passed to captureException is a SvelteKit plain-object error { type, error, status }, not an Error instance. This indicates is4xxError(input) returned false, allowing the capture to proceed.

Additional Context

The __data.json request itself returns HTTP 200 — the 403 is embedded in the JSON body, not the HTTP status. That means SvelteKit's get_status(error) receives a plain deserialized object, not an HttpError instance, and falls back to returning 500.

HTTP/1.1 200 OK
Vary: Origin
cache-control: private, no-store
content-length: 105
content-type: application/json
Date: Thu, 25 Jun 2026 07:55:40 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"type":"data","nodes":[{"type":"skip"},{"type":"error","error":{"message":"Error: 403"},"status":403}]}

Priority

No response

[linear-code]

JS-2864

[hyunbinseo]

This is the fix I've been suggested with:

// packages/sveltekit/src/client/handleError.ts
// ...

function is4xxError(input: SafeHandleServerErrorInput): boolean {
 const { status } = input;

 if (status && status >= 400 && status < 500) {
 return true;
 }

 // SvelteKit __data.json requests return HTTP 200 with errors embedded in JSON,
 // so get_status() may resolve to 500 for a deserialized plain error object.
 // Fall back to checking input.error.status directly.
 const errorStatus =
 typeof input.error === 'object' && input.error !== null
 ? (input.error as Record<string, unknown>)['status']
 : undefined;

 return typeof errorStatus === 'number' && errorStatus >= 400 && errorStatus < 500;
}

// packages/sveltekit/test/client/handleError.ts
// ...

it.each([400, 401, 403, 404, 429, 499])(
 "doesn't capture %s errors embedded in __data.json (HTTP 200 wrapper)",
 async statusCode => {
 const wrappedHandleError = handleErrorWithSentry(handleError);
 await wrappedHandleError({
 // SvelteKit resolves get_status() to 500 for plain deserialized error objects
 status: 500,
 error: { type: 'error', error: { message: `Error: ${statusCode}` }, status: statusCode },
 event: navigationEvent,
 message: `Error: ${statusCode}`,
 });

 expect(mockCaptureException).not.toHaveBeenCalled();
 },
);

[Lms24]

@hyunbinseo thanks for reporting and for proposing the fix! The proposed code looks good to me. Would you like to open a PR for it? If not, we can take that over and we'll credit you either way. Whatever you prefer!

[hyunbinseo]

Could you open the PR? Would love to be credited.