Skip to content

feat(baggage): Added double baggage prevention logic#19597

Open
harshit078 wants to merge 15 commits intogetsentry:developfrom
harshit078:baggage-sent-twice
Open

feat(baggage): Added double baggage prevention logic#19597
harshit078 wants to merge 15 commits intogetsentry:developfrom
harshit078:baggage-sent-twice

Conversation

@harshit078
Copy link
Contributor

@harshit078 harshit078 commented Mar 3, 2026

Before submitting a pull request, please take a look at our
Contributing guidelines and verify:

  • If you've added code that should be tested, please add tests.
  • Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  • Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.

Closes #19158

@Lms24
Copy link
Member

Lms24 commented Mar 13, 2026

Hey @harshit078 thanks for taking over the issue and opening the PR! I see there are some tests failing regarding the mergeBaggageHeaders function. Are you aware of this and looking into fixing it or should we take over? Just let me know :)

There's one test named "overwrites existing Sentry entries with new ones", so I'm wondering why we'd end up with duplicated entries. This might be related to #17355 which got merged yesterday.

@harshit078
Copy link
Contributor Author

Hey @Lms24 , yes I am resolving the current failing tests and pushing a fix for it. I'll mark the PR as ready to review as soon as all tests pass

@github-actions
Copy link
Contributor

github-actions bot commented Mar 18, 2026

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


New Features ✨

  • (baggage) Added double baggage prevention logic by harshit078 in #19597

Bug Fixes 🐛

Deps

  • Bump devalue 5.6.3 to 5.6.4 to fix CVE-2026-30226 by chargome in #19849
  • Bump file-type to 21.3.2 and @nestjs/common to 11.1.17 by chargome in #19847
  • Bump unhead 2.1.4 to 2.1.12 to fix CVE-2026-31860 and CVE-2026-31873 by chargome in #19848
  • Bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141 by chargome in #19842
  • Bump tar 7.5.10 to 7.5.11 to fix CVE-2026-31802 by chargome in #19846
  • Bump hono 4.12.5 to 4.12.7 in cloudflare-hono E2E test app by chargome in #19850
  • Bump undici 6.23.0 to 6.24.1 to fix multiple CVEs by chargome in #19841

Other

  • (deno) Clear pre-existing OTel global before registering TracerProvider by sergical in #19723

Internal Changes 🔧

  • (deps) Bump next from 16.1.5 to 16.1.7 in /dev-packages/e2e-tests/test-applications/nextjs-16 by dependabot in #19851
  • (react) Add gql tests for react router by chargome in #19844
  • (release) Switch from action-prepare-release to Craft by BYK in #18763

🤖 This preview updates automatically when you update the PR.

@harshit078 harshit078 marked this pull request as ready for review March 18, 2026 12:22
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

const baggageString = Array.isArray(baggageHeader) ? baggageHeader.join(',') : baggageHeader;

return baggageString.split(',').some(entry => entry.trim().startsWith(SENTRY_BAGGAGE_KEY_PREFIX));
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New hasSentryBaggageValues function is unused in production

Medium Severity

The newly exported hasSentryBaggageValues function is never imported or called in any production code. Only mergeBaggageHeaders is imported from this module (by outgoingFetchRequest.ts and outgoingHttpRequest.ts). Given the PR's goal of "double baggage prevention," this function appears intended to guard against adding duplicate sentry baggage entries in the outgoing request handlers — similar to how baggageHeaderHasSentryBaggageValues is used in packages/core/src/fetch.ts — but the wiring was never added. This likely means the feature is incomplete.

Fix in Cursor Fix in Web

expect(results.test4.hasCustomBaggage).toBe(true);
expect(results.test4.sentryTrace).toBeDefined();
expect(results.test4.baggage).toContain('custom-key=value');
expect(results.test4.sentryBaggageCount).toBeGreaterThan(0);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Integration test doesn't verify baggage deduplication was prevented

Medium Severity

The integration test for "double baggage prevention" uses toBeGreaterThan(0) for sentryBaggageCount, which would pass even if sentry baggage entries were duplicated 10x. The test expects duplicate entries NOT to exist but never actually asserts this. For test1/test3/test4 (the manual + auto-instrumentation scenarios), the sentryBaggageCount needs to be compared against the expected unique count, or the test2 baseline count, to actually verify deduplication. As written, these assertions don't test the newly added behavior.

Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

baggage is sent twice when tracesSampleRate is set and Sentry.getTraceData() is added manually

2 participants