feat: Accept `tunnel: true` in `init` to enable the managed tunnel by logaretm · Pull Request #25200 · getsentry/sentry-javascript

logaretm · 2026-10-08T15:45:35Z

Previously the client side only accepted a string tunnel option so it sent the requests to that fixed endpoint, this PR effectively adds "managed" tunnel support that is generated automatically from the provided DSN.

This PR adds the tunnel options to the SDKs's init options and implements the client transport if the tunnel is provided.

closes #25460

github-actions · 2026-10-08T16:12:54Z

size-limit report 📦

⚠️ Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Path	Size	% Change	Change
@sentry/browser	30.53 kB	+2.18%	+649 B 🔺
@sentry/browser - with treeshaking flags	28.51 kB	+1.75%	+490 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing	28.39 kB	+1.7%	+473 B 🔺
@sentry/browser (incl. Tracing)	52.77 kB	+1.35%	+699 B 🔺
@sentry/browser (incl. Tracing + Span Streaming)	52.77 kB	+1.35%	+698 B 🔺
@sentry/browser (incl. Tracing, Profiling)	55.74 kB	+1.32%	+721 B 🔺
@sentry/browser (incl. Tracing, Replay)	92.44 kB	+0.68%	+616 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	81.18 kB	+0.62%	+496 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	97.18 kB	+0.66%	+629 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	110.17 kB	+0.63%	+683 B 🔺
@sentry/browser (incl. Feedback)	48.09 kB	+1.48%	+699 B 🔺
@sentry/browser (incl. sendFeedback)	35.6 kB	+1.9%	+662 B 🔺
@sentry/browser (incl. FeedbackAsync)	40.73 kB	+1.71%	+683 B 🔺
@sentry/browser (incl. Metrics)	31.54 kB	+2.05%	+633 B 🔺
@sentry/browser (incl. Logs)	31.81 kB	+2.01%	+626 B 🔺
@sentry/browser (incl. Metrics & Logs)	32.48 kB	+2.11%	+670 B 🔺
@sentry/react	32.33 kB	+2%	+631 B 🔺
@sentry/react (incl. Tracing)	55.02 kB	+1.17%	+633 B 🔺
@sentry/vue	38.68 kB	+1.7%	+643 B 🔺
@sentry/vue (incl. Tracing)	55.72 kB	+1.31%	+716 B 🔺
@sentry/svelte	30.56 kB	+2.2%	+657 B 🔺
@sentry/remix (Remix 3 client bundle)	57.8 kB	+1.26%	+715 B 🔺
CDN Bundle	32.11 kB	+1.49%	+470 B 🔺
CDN Bundle (incl. Tracing)	53.06 kB	+0.91%	+478 B 🔺
CDN Bundle (incl. Logs, Metrics)	34.31 kB	+1.41%	+474 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	55.01 kB	+0.89%	+483 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)	75.26 kB	+0.66%	+492 B 🔺
CDN Bundle (incl. Tracing, Replay)	90.73 kB	+0.53%	+478 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	92.66 kB	+0.52%	+479 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	96.87 kB	+0.49%	+468 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	98.83 kB	+0.5%	+489 B 🔺
CDN Bundle - uncompressed	94.33 kB	+1.24%	+1.15 kB 🔺
CDN Bundle (incl. Tracing) - uncompressed	157.19 kB	+0.74%	+1.15 kB 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed	100.87 kB	+1.16%	+1.15 kB 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	163.14 kB	+0.72%	+1.15 kB 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	230.91 kB	+0.51%	+1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	277.35 kB	+0.42%	+1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	283.3 kB	+0.41%	+1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	291.06 kB	+0.4%	+1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	296.99 kB	+0.39%	+1.15 kB 🔺
@sentry/nextjs (client)	57.45 kB	+1.08%	+613 B 🔺
@sentry/sveltekit (client)	53.08 kB	+1.2%	+627 B 🔺
@sentry/core/server	42.85 kB	+4.18%	+1.72 kB 🔺
@sentry/core/browser	13.81 kB	-	-
@sentry/node	155.81 kB	+0.47%	+719 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	84.06 kB	-	-
@sentry/node - without tracing	97.48 kB	+0.73%	+702 B 🔺
@sentry/node - without channel injection	133.81 kB	+0.53%	+693 B 🔺
@sentry/aws-serverless	105.75 kB	+0.78%	+816 B 🔺
@sentry/cloudflare (withSentry) - minified	212.9 kB	+0.96%	+2.01 kB 🔺
@sentry/cloudflare (withSentry)	528.07 kB	+0.94%	+4.9 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified	230.58 kB	+0.89%	+2.01 kB 🔺

View base workflow run

logaretm · 2026-10-15T21:56:00Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

logaretm · 2026-10-16T02:14:23Z

bugbot run

logaretm · 2026-10-16T02:14:41Z

bugbot run

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2f8c1eb. Configure here.}

Setting `tunnel: true` (or `{ allowedDsns, basePath, trailingSlash }`) in both the browser and the server `init` enables the managed tunnel. The browser resolves it to the DSN-derived same-origin path and sends envelopes as `application/x-sentry-envelope`, because SvelteKit and Astro CSRF checks reject a same-origin `text/plain` POST. Server SDKs keep their own envelopes going directly to Sentry and set `_managedTunnel` for their request handlers.

With `debug: true`, the client warns once when a managed tunnel request gets a 403, 404 or 405, pointing at the server side: a meta-framework SDK, an endpoint calling `handleTunnelRequest`, or `allowedDsns`.

…n sends events

…el isn't served

…ed tunnel

…r does

…through it

…naged tunnel request with a 4xx

…port, and import server helpers from core/server Only the browser sends to a managed tunnel, so the warning moves from the shared Client into the browser's tunnel transport. Server SDKs import resolveServerTunnelOption from @sentry/core/server.

The reason strings were built in production bundles too, while only the debug warning that printed them was stripped.

…nel tests `isTunnelRequest` only reads the active server client now, and the paths are already checked against `getTunnelPath`.

…path, which is the managed tunnel to serve

logaretm added this pull request to stack #25201 October 8, 2026 15:45

logaretm force-pushed the awad/tunnel-browser-managed branch from ec2da8d to 2933944 Compare October 8, 2026 16:05

logaretm changed the title ~~feat(browser): Add applyManagedTunnel to point the tunnel at the DSN-derived path~~ feat: Accept tunnel: true in init to enable the managed tunnel Oct 8, 2026

logaretm force-pushed the awad/tunnel-browser-managed branch from 2933944 to 4837dc0 Compare October 15, 2026 14:38

logaretm force-pushed the awad/tunnel-browser-managed branch 2 times, most recently from d5c110f to 4ab6297 Compare October 15, 2026 14:44

logaretm force-pushed the awad/tunnel-browser-managed branch from 4ab6297 to bf1d62c Compare October 15, 2026 14:47

logaretm force-pushed the awad/tunnel-browser-managed branch 3 times, most recently from 75a299e to b1553a8 Compare October 15, 2026 15:36

logaretm force-pushed the awad/tunnel-browser-managed branch from b1553a8 to 0e573ca Compare October 15, 2026 15:51

logaretm changed the title ~~feat: Accept tunnel: true in init to enable the managed tunnel~~ feat: Accept tunnel: true in the SDKs that serve the managed tunnel Oct 15, 2026

logaretm force-pushed the awad/tunnel-browser-managed branch from 1d77f74 to 80f1700 Compare October 15, 2026 17:15

logaretm changed the title ~~feat: Accept tunnel: true in the SDKs that serve the managed tunnel~~ feat: Accept tunnel: true in init to enable the managed tunnel Oct 15, 2026

logaretm force-pushed the awad/tunnel-browser-managed branch 4 times, most recently from a769b10 to d79df66 Compare October 15, 2026 18:28

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread packages/core/src/client.ts Outdated

Comment thread packages/browser/src/utils/managedTunnel.ts

logaretm force-pushed the awad/tunnel-browser-managed branch from d79df66 to 8717465 Compare October 16, 2026 01:51

logaretm force-pushed the awad/tunnel-browser-managed branch from 8e2532e to 3300b3b Compare October 19, 2026 18:15

logaretm force-pushed the awad/tunnel-browser-managed branch from 3300b3b to 61f49c4 Compare October 19, 2026 18:22

logaretm force-pushed the awad/tunnel-browser-managed branch from 61f49c4 to 2f8c1eb Compare October 19, 2026 19:12

logaretm marked this pull request as ready for review October 19, 2026 19:36

logaretm requested review from a team as code owners October 19, 2026 19:36

logaretm requested review from JPeer264, Lms24, isaacs and mydea and removed request for a team October 19, 2026 19:36

cursor Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread packages/browser/src/sdk.ts

Comment thread packages/browser/src/utils/managedTunnel.ts

logaretm added 14 commits October 19, 2026 16:05

feat: Explain a managed tunnel that nothing on the server answers

6bc086d

With `debug: true`, the client warns once when a managed tunnel request gets a 403, 404 or 405, pointing at the server side: a meta-framework SDK, an endpoint calling `handleTunnelRequest`, or `allowedDsns`.

fix(core): Keep the managed tunnel warning out of production bundles

612ce1c

fix(aws-serverless): Keep the managed tunnel when the Lambda extensio…

91e1aac

…n sends events

fix(core): Point Next.js users to tunnelRoute when the managed tunn…

04636bf

…el isn't served

feat(browser): Send directly to Sentry when nothing answers the manag…

f9f9abf

…ed tunnel

fix(browser): Normalize the managed tunnel's base path like the serve…

5b8ed41

…r does

fix(browser): Keep the managed tunnel when Sentry answers 404 or 405 …

d531ec5

…through it

fix(browser): Send directly when anything but the tunnel answers a ma…

493edb8

…naged tunnel request with a 4xx

ref(browser): Switch the managed tunnel to direct sends in one place

16d775d

The reason strings were built in production bundles too, while only the debug warning that printed them was stripped.

test(browser): Drop the server-side tunnel match from the browser tun…

76e6866

…nel tests `isTunnelRequest` only reads the active server client now, and the paths are already checked against `getTunnelPath`.

ref(browser): Trim the managed tunnel comments

7497f59

fix(aws-serverless): Keep the Lambda extension for a relative tunnel …

8a85d2d

…path, which is the managed tunnel to serve

logaretm force-pushed the awad/tunnel-browser-managed branch from 2f8c1eb to 8a85d2d Compare October 19, 2026 20:07

Navigation Menu

Repository navigation

feat: Accept `tunnel: true` in `init` to enable the managed tunnel - #25200

feat: Accept `tunnel: true` in `init` to enable the managed tunnel#25200
logaretm wants to merge 14 commits into
awad/tunnel-core-dsn-pathfrom
awad/tunnel-browser-managed

logaretm commented Oct 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 8, 2026 •

edited

Loading

Uh oh!

logaretm commented Oct 15, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

logaretm commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

logaretm commented Oct 15, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

logaretm commented Oct 16, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

logaretm commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading