Replay: Optionally attach HTTP request/response payloads

[bruno-garcia]

Problem Statement

Replay can display all the network calls done during the user session.
It's not visible the data sent or received.

Solution Brainstorm

Similar to browser dev tools, optionally (opt-in) capture the request/response.

This should be opt-in.

[toksdotdev]

Is there a tentative date for when this might be available?

[bruno-garcia]

a few concerns we have that need discussing:

• PII in the payload
• Size; this can easily take the size beyond the limit. Can we use attachments?

Relates to: https://github.com/getsentry/rfcs/blob/main/text/0022-response-context.md

[mydea]

So, I just looked at that in more detail, and it'll probably be harder/more problematic than expected:

1. We currently have the response available on the sentry-internal fetch breadcrumb. However, you can only read the response body once from there, which means we can't actually read it 😬 because otherwise a user can't read it anymore. So at most we can get e.g. the status code or something like this. This restriction may not apply to xhr, haven't tested that yet.
2. We currently do not put the request body on the breadcrumb, so can't read it from there. We could start putting this there, but this would then be added to non-replay events as well. This is just to consider, as body payloads may be quite large, I guess.

[billyvg]

1. We currently have the response available on the sentry-internal fetch breadcrumb. However, you can only read the response body once from there, which means we can't actually read it 😬 because otherwise a user can't read it anymore. So at most we can get e.g. the status code or something like this. This restriction may not apply to xhr, haven't tested that yet.

You can clone the response object before reading it.

[timonbimon]

just wanted to say that this is currently the only thing missing from Sentry for us to switch from Logrocket (see random screenshot from Logrocket that is super helpful when debugging). it seems that this is already available for other language (like Python, but not Javascript 🤔).

[ffxsam]

I'd go so far as to say not having this feature is sort of a deal-breaker. Seeing when the error occurred is great, but not being able to see the API request/response reduces the usefulness of this feature significantly.