transportOptions not setting headers

[martinkwan]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using? If you use the CDN bundles, please specify the exact bundle (e.g. bundle.tracing.min.js) in your SDK setup.

@sentry/react

SDK Version

7.22.0

Framework Version

React 17.0.2

Link to Sentry event

No response

SDK Setup

 Sentry.init({
 dsn: this.sentryKey,
 release: this.releaseTag,
 environment: process.env.NODE_ENV,
 integrations: [
 new BrowserTracing({
 tracingOrigins: [],
 routingInstrumentation: Sentry.reactRouterV5Instrumentation(
 HISTORY_SINGLETON,
 getRouteConfigsForSentryPerf([
 ...Object.values(FLAT_ROUTES),
 ...Object.values(DeprecatedROUTES),
 ]),
 matchPath,
 ),
 shouldCreateSpanForRequest: (url) => {
 const gqlUrl = HttpRequestUtil.getGqlUrl();
 const isGqlUrl = url === gqlUrl;
 return !isGqlUrl;
 },
 _metricOptions: {
 _reportAllChanges: true,
 },
 heartbeatInterval: 10000,
 }),
 new Sentry.Integrations.Breadcrumbs({console: false}),
 ],
tracesSampleRate: 1,
transportOptions: {
 headers: {'Origin': 'test.com'},
}});

Steps to Reproduce

1. Open Network request tab
2. Origin is not changed (is still http://localhost:3000)
   

Is there a way to change or hide the origin header? My goal is to hide the origin header as it contains sensitive data.

Expected Result

Origin header is changed to test.com

Actual Result

Origin header is not changed

[lforst]

Hi, sadly it is impossible to set the Origin header since it is automatically set by the browser - presumably for security reasons.

You can try the following and will see that it won't work:

fetch('https://example.com/', { headers: { "Origin": "foobar" }})

[martinkwan]

Thank you, @lforst do you know if Sentry.io stores the data from theOrigin header in any way? My usecase is that the customer url has sensitive data.

If I obfuscate all the urls in the beforeSend and beforeSendTransaction functions, that should obfuscate all the urls, is that right?

[lforst]

If I obfuscate all the urls in the beforeSend and beforeSendTransaction functions, that should obfuscate all the urls, is that right?

That should work yes!