Skip to content

fix(browser): resolve request URLs against location.href in tracing - #25784

Open
kunal649 wants to merge 1 commit into
getsentry:developfrom
kunal649:kunal/fix/tracing-url-href-base
Open

kunal649 wants to merge 1 commit into
getsentry:developfrom
kunal649:kunal/fix/tracing-url-href-base

Conversation

@kunal649

Copy link
Copy Markdown
Contributor

Why:
getFullURL and the browser tracing request URL logic were resolving URLs against location.origin. That breaks in two important cases:

  • In sandboxed iframes and data: pages, location.origin can be the string "null". new URL() parses the base before the input, so it throws even for absolute URLs. This caused XHR spans to lose url.full and fetch spans to lose url.domain.
  • Relative URLs without a leading slash (for example users on /dashboard/settings) were resolved against the wrong base, producing incorrect url.full values.

We now resolve against location.href, which is valid in opaque-origin contexts and preserves the correct relative URL behavior for normal pages.

How to review:
Start with:

  • packages/browser/src/tracing/utils.ts
  • packages/browser/src/tracing/request.ts

and the regression coverage in:

  • packages/browser/test/tracing/request.test.ts

The key things to check are the URL normalization behavior for opaque origins and relative paths without a leading slash.

Unsure about:
Whether the empty-URL breadcrumb behavior should be handled in a separate follow-up, since it is related but intentionally not included in this fix.

Ref #13168

@kunal649
kunal649 requested a review from a team as a code owner October 27, 2026 20:45
@kunal649
kunal649 requested review from logaretm and msonnb and removed request for a team October 27, 2026 20:45
@github-actions github-actions Bot added the external PR from an external contributor label Oct 27, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1590376. Configure here.

startTimestamp: Date.now(),
} as utils.HandlerDataXhr);

expect(utils.spanToJSON(requestSpan!).attributes['url.full']).toBe(expected);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests use raw span attribute strings

Low Severity

This was flagged because the review guidelines require test assertions on span attributes to use @sentry/conventions constants rather than string literals. The new checks read url.full and url.domain as raw strings.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Reviewed by Cursor Bugbot for commit 1590376. Configure here.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external PR from an external contributor

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant