feat(node): Add incoming request headers as OTel span attributes

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
  import: createImport('init'),
  ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
  gzip: true,
- limit: '152 KB',
+ limit: '154 KB',
  },
  {
  name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
  'sentry.sample_rate': 1,
  'sentry.source': 'route',
  url: expect.stringContaining('/test-ssr'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  op: 'http.server',
  origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/myUsername123'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/api/user/myUsername123.json'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
  url: expect.stringContaining('/user-page/settings'),
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'navigate',
+ 'http.request.header.user_agent': expect.any(String),
  },
  },
  },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
  'sentry.op': 'http.server',
  'sentry.origin': 'auto.http.astro',
  'sentry.source': 'route',
+ 'http.request.header.accept': expect.any(String),
+ 'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+ 'http.request.header.accept_language': 'en-US',
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': expect.any(String),
  }),
  op: 'http.server',
  origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-http/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-inbound-headers/:id',
+ 'http.request.header.baggage': expect.any(String),
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
  },
  op: 'http.server',
  parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
  const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+ const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+ // Outgoing span (`http.client`) does not include headers as attributes
+ expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
  expect(traceId).toEqual(expect.any(String));
 
  // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-outgoing-fetch/:id',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/example-module/transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
  "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
  "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
  "test:prod": "TEST_ENV=production playwright test",
+ "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
  "test:dev": "TEST_ENV=development playwright test",
  "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
  "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
  },
  {
  "build-command": "pnpm test:build-turbo",
- "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+ "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
  "label": "nextjs-15 (turbo)"
  }
  ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
  return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
  }
 
- if (testEnv === 'production') {
+ if (testEnv === 'production' || testEnv === 'prod-turbopack') {
  return 'pnpm next start -p 3030';
  }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
  expect(pageloadTraceId).toBeTruthy();
  expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+ test.skip(
+ process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+ 'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+ );
+
+ const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'GET /pageload-tracing';
+ });
+
+ await fetch(`${baseURL}/pageload-tracing`, {
+ headers: {
+ 'User-Agent': 'Custom-NextJS-Agent/15.0',
+ 'Content-Type': 'text/html',
+ 'X-NextJS-Test': 'nextjs-header-value',
+ Accept: 'text/html, application/xhtml+xml',
+ 'X-Framework': 'Next.js',
+ 'X-Request-ID': 'nextjs-789',
+ },
+ });
+
+ const serverTransaction = await serverTransactionPromise;
+
+ expect(serverTransaction.contexts?.trace?.data).toEqual(
+ expect.objectContaining({
+ 'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+ 'http.request.header.content_type': 'text/html',
+ 'http.request.header.x_nextjs_test': 'nextjs-header-value',
+ 'http.request.header.accept': 'text/html, application/xhtml+xml',
+ 'http.request.header.x_framework': 'Next.js',
+ 'http.request.header.x_request_id': 'nextjs-789',
+ }),
+ );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
  'http.status_code': 200,
  'http.status_text': 'OK',
  'http.route': '/test-transaction',
+ 'http.request.header.accept': '*/*',
+ 'http.request.header.accept_encoding': 'gzip, deflate',
+ 'http.request.header.accept_language': '*',
+ 'http.request.header.connection': 'keep-alive',
+ 'http.request.header.host': expect.any(String),
+ 'http.request.header.sec_fetch_mode': 'cors',
+ 'http.request.header.user_agent': 'node',
  },
  op: 'http.server',
  span_id: expect.stringMatching(/[a-f0-9]{16}/),