FormData not logged with RequestData integration

[jansedlon]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/remix

SDK Version

7.93.0

Framework Version

No response

Link to Sentry event

https://flixy.sentry.io/issues/4886483599/?environment=local&project=4506188644155392&query=is%3Aunresolved&referrer=issue-stream&statsPeriod=14d&stream_index=0

SDK Setup

Sentry.init({
    dsn: ENV.SENTRY_DSN,
    tracesSampleRate: env.APP_ENV === "production" ? 0.5 : 0.1,
    environment: env.SENTRY_ENVIRONMENT,
    denyUrls: [
      /\/resources\/healthcheck/,
      /\/build\//,
      /\/favicons\//,
      /\/images\//,
      /\/fonts\//,
      /\/favicon.ico/,
      /\/site\.webmanifest/,
      /.*\.map$/,
    ],
    maxValueLength: 5000,
    integrations: [
      new Sentry.Integrations.Http({ tracing: true }),
      new Sentry.Integrations.Prisma({ client: prisma }),
      new ProfilingIntegration(),
      new Sentry.Integrations.RequestData(),
    ],
    beforeSendTransaction(event) {
      if (event.request?.url?.includes("/healthcheck")) return null;

      return event;
    },
  });

Steps to Reproduce

codesandbox

Expected Result

When a fetcher is submitted with form data or a Form is submitted with POST, it should log FormData in Sentry. I went through the source code of RequestData integration, I even debugged it and found out that the request body in @sentry/utils requestdata.js -> extractRequestData does not exist.

Actual Result

Cannot find any mention of request data. Sometimes the only thing it shows is something like request_body_size

[Lms24]

Hi @jansedlon thanks for writing in! After discussing this in our team, I think we have two issues here which we should both tackle individually:

1. our RequestData integration picks up the request from event.sdkProcessingMetadata. We suspect that the Remix SDK might not set this field correctly. We should verify if this is the problem, i.e. if the data is even available to the integration. Unless I'm completely missing something, the form data should be available in req.body which we already extract.
2. request body data should not be attached by default, given the high likelihood of it containing PII. We should gate adding the field behind the sendDefaultPII SDK option.

cc @onurtemizkan - when you have time, please take a look. ideally we resolve both (in separate PRs).

[jansedlon]

Hi @Lms24 thank you very much for your response. The request data should be available, but the body property in event.sdkProcessingMetadata.req is undefined or doesn't exist at all.

[onurtemizkan]

Thanks for reporting this @jansedlon.

Yes, it seems body / formData is not always available when using an Express server in Remix. Which looks like the expected behaviour (See: remix-run/remix#3616)

@Lms24 - We can manually extract formData by cloning the request in action and consuming it. Then we can attach it to the scope in action. Which is not the most performance-efficient way but it's possible.

Instead of using setSDKProcessingMetadata, we can attach it to the action span, similarly how it's done in @sentry/nextjs

sentry-javascript/packages/nextjs/src/common/withServerActionInstrumentation.ts

Lines 110 to 117 in 5f0b506

	if (options.formData) {
	options.formData.forEach((value, key) => {
	span?.setAttribute(
	`server_action_form_data.${key}`,
	typeof value === 'string' ? value : '[non-string value]',
	);
	});
	}

What do you think? Should I go forward with that workaround?