Skip to content

bug(auth): Fix polluted sentry captures#20090

Merged
dschom merged 1 commit intomainfrom
FXA-13177
Feb 25, 2026
Merged

bug(auth): Fix polluted sentry captures#20090
dschom merged 1 commit intomainfrom
FXA-13177

Conversation

@dschom
Copy link
Contributor

@dschom dschom commented Feb 21, 2026

Because

  • We would see context from other errors cross pollinate
  • In auth server error capture was particularly poor

This pull request

  • Removes old cruft that is no longer needed with sentry 10
  • Now that Sentry uses, OTEL under the hood makes necessary adjustments to our OTEL initialization
  • Adds handler for testing / validating this works
  • Updates logic to ensure proper initialization of both OTEL and Sentry.
  • Makes adjustments to libs/shared to keep things aligned
  • Fixes logger so sentry tracid is captured.

Issue that this pull request solves

Closes: FXA-13177

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Testing is largely exploratory. Here's some tips

Add this to your .env, run dotenv -- yarn start

SENTRY_ENV=local
SENTRY_DSN_AUTH=[REDACTED]
TRACING_SAMPLE_RATE=1
TRACING_BATCH_PROCESSING=false
TRACING_OTEL_EXPORTER_ENABLED=true
TRACING_OTEL_COLLECTOR_ENABLED=true
TRACING_OTEL_COLLECTOR_JAEGER_ENABLED=true

Then run seq 1 15 | xargs -n1 -P5 -I{} curl -s http://localhost:9000/v1/boom and check Sentry, with a 'local' env filter. You might have wait a minute, but you will see the capture, and you'll notice the traces are isolated again.

@dschom dschom requested a review from a team as a code owner February 21, 2026 01:17
@dschom dschom mentioned this pull request Feb 21, 2026
4 tasks
@dschom dschom force-pushed the FXA-13177 branch 4 times, most recently from fb236e0 to e6273ee Compare February 24, 2026 00:23
nodeTracingInitialized = !!initTracing(config.tracing, log);
}

// Important! Order matters here. If otel is configured, this shoudl be done after OTEL initialization!
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lots of important things in here 😅

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, turns out there's a couple ways to shoot yourself in the foot here... Don't ask how I'd know. 😅

eventFilters: [filterSentryEvent],
integrations: [Sentry.linkedErrorsIntegration({ key: 'jse_cause' })],
integrations: [
// Important! This fixes a ton of problems with our previous integration.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👀

//*/

Sentry.setExtra('request_payload', request.app?.acceptLanguage || {});
Sentry.setExtra('request_payload', request.payload || {});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could potentially log authPW or other sensitive user data?

Copy link
Contributor Author

@dschom dschom Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, however when testing this it appeared to get filtered out over on Sentry's side by filtering settings there. I'd be open to redacting certain fields though. I can't see our org wide policies, and someone could change them at any time, so you are probably right that doing this in code is safer.


Sentry.setExtra('request_payload', request.app?.acceptLanguage || {});
Sentry.setExtra('request_payload', request.payload || {});
Sentry.setExtra('request_headers', request.headers || {});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same idea here, we could log the authorization header.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vbudhram I just included a filtering function.

@vbudhram
Copy link
Contributor

vbudhram commented Feb 25, 2026

Finally got Sentry setup, events do come in with your STR

Screenshot 2026-02-24 at 4 13 45 PM

Because:
- We would see context from other errors cross pollinate
- In auth server error capture was particularly poor

This Commit:
- Removes old cruft that is no longer needed with sentry 10
- Now that Sentry uses, OTEL under the hood makes necessary adjustments to our OTEL initialization
- Adds handler for testing / validating this works
- Updates logic to ensure proper initialization of both OTEL and Sentry.
- Makes adjustments to libs/shared to keep things aligned
- Stops writing requests to error object. This now happens via the integration.
- Sets the user state on the error
@dschom dschom merged commit adf1f60 into main Feb 25, 2026
6 of 10 checks passed
@dschom dschom deleted the FXA-13177 branch February 25, 2026 19:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants