Next.js SDK not injected in dev mode

[larsqa]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which package are you using?

@sentry/nextjs

SDK Version

7.21.0

Framework Version

Next.js v12.3.0

Link to Sentry event

No response

Steps to Reproduce

In a sentry.server.config.js, use the beforeSend:

Sentry.init({
 ...
 beforeSend(event) {
 console.log("SENTRY EVENT");
 return event;
 },
});

Expected Result

The console log of "SENTRY EVENT" doesn't show up in the terminal.
Using the same method in a sentry.client.config.js does, however, trigger the console log in the browser's console.

Actual Result

I'm uncertain if this is intended or neglected. It seems that the client and server use different config SDK's.
I was only able to find the type definition of beforeSend in the client config, not server config.

[lforst]

Hi are you using nextjs dev mode or the production build mode?

[larsqa]

I just tested with npm run build & npm run start and here beforeSend works server side.
However, it does not work with npm run dev.

How come? I'd really hate to develop my beforeSend data scrubbing by building and running it.

[lforst]

I believe it is because you're on version 7.21.0 of the SDK. That version had a bug where we didn't inject the SDK in dev mode. You should be able to upgrade to 7.21.1 to fix this.

[larsqa]

I believe you're referring to #6284, which was reported by me. Here, 7.21.1 was the malfunctioning version, where 7.21.0 works.

[lforst]

Oh whoops the fix I wanted to refer to isn't released yet. Sorry about that. Will be out shortly.

[larsqa]

Alright - looking forward. I'd imagine that it will be released as a patch version?

Moreover, I have a hard time figuring out how to use SDK Data Scrubbing correctly.
beforeSend has event and hint arguments. I believe event is what is finally sent to Sentry, where hint provides additional context to write my custom filter rules.
Also, looking at Server-Side Data Scrubbing, it seems that your predefined rules are triggered in objects.

However, let's say I'd like to scrub out Social Security Numbers (SSN), how do I know from the available event properties and/or the API where to look for an occurrence of SSN?
Should I go through the whole event object and check for any key that may have a SSN string in it (ssn, socialNumber, socialSecurityNumber, ...) + check in each key→value for any SSN formats (XXXXXXXXXX, XXX-XXX-XXX, ...)?

[lforst]

Should I go through the whole event object and check for any key that may have a SSN string in it (ssn, socialNumber, socialSecurityNumber, ...) + check in each key→value for any SSN formats (XXXXXXXXXX, XXX-XXX-XXX, ...)?

Yeah there's no clear cut way where to look for it. It all depends on how you set up the SDK. PII might be everywhere - breadcrumbs, in the error messages, even in stack traces sometimes. We recommend being careful when handling data like that.

Alright - looking forward. I'd imagine that it will be released as a patch version?

We'll probably release it as a minor.

[larsqa]

Yeah there's no clear cut way where to look for it. It all depends on how you set up the SDK. PII might be everywhere - breadcrumbs, in the error messages, even in stack traces sometimes. We recommend being careful when handling data like that.

It seems like, based from your response, that the best option is to deep-filter through the event object and check on both key and values for strings and/or formats.

For someone who's never used Sentry before, this adds a learning curve and overhead - rather of it being plug/play. Here it might be helpful to have example repositories using best practices, what to look out for, good approaches for deep filtering, ..., just like Next.js did. Online searches mainly show too simple examples to be used in a real setup.

[lforst]

For someone who's never used Sentry before, this adds a learning curve and overhead - rather of it being plug/play. Here it might be helpful to have example repositories using best practices, what to look out for, good approaches for deep filtering, ..., just like Next.js did. Online searches mainly show very high-level examples.

That is good feedback. Thank you!

We want Sentry to be as plug-and-play as possible, however, some features sadly push it over the tooling edge and data scrubbing is one of them. It's a complicated and advanced use case. We have docs on it that you can look at, but since everybody's app is different there is no one-size-fits-all solution we can chase.

[larsqa]

... but since everybody's app is different there is no one-size-fits-all solution we can chase.

Agree - but this is an "opinionated" tool built by you. As a user, I'd like to see your opinions how to best tackle e.g. e-mail, SSN, address,... SDK data scrubbing. With multiple examples, you'll be able to emphasize strategies, and I'll be able to build my own castle with the few bricks you provided.