ref(seer): Send proxy_headers as JWT instead of legacy JSON+HMAC#113342
Merged
Conversation
Today `get_proxy_headers()` builds the auth Seer echoes back to Sentry on Code Mode callbacks using the legacy two-header format: a JSON- serialized ViewerContext under `X-Viewer-Context` plus a separate `X-Viewer-Context-Signature` HMAC header. That format predates the JWT path used everywhere else in the ViewerContext flow. Switch to a single `X-Viewer-Context` JWT, encoded with the existing `encode_viewer_context` helper. Sentry's middleware already accepts both formats (JWT first, falls back to legacy + signature), so the receiving side needs no change. The JWT also carries an `exp` claim, which the legacy format didn't — strictly tighter than the current behavior. The Seer side (which currently echoes whatever headers it received as a dict) doesn't care — it just hands the dict back. So a single-header response Just Works on the seer side too. Co-Authored-By: Claude <noreply@anthropic.com>
github-actions
Bot
added
the
Scope: Backend
gricha
marked this pull request as ready for review
April 17, 2026 19:45
azulus
approved these changes
Apr 17, 2026
azulus
left a comment
azulus
left a comment
Member
There was a problem hiding this comment.
assuming you tested locally and it works, lgtm
Member
Author
|
k landed another to seer side, confirmed this works locally |
Contributor
|
PR reverted: 7d54c95 |
Contributor
|
PR reverted: 7d54c95 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
get_proxy_headers()builds the auth Seer echoes back to Sentry on Code Mode callbacks. Today it uses the legacy two-header format — a JSON-serialized ViewerContext underX-Viewer-Contextplus a separateX-Viewer-Context-SignatureHMAC header. That format predates the JWT path used everywhere else in the ViewerContext flow.Switch to a single
X-Viewer-ContextJWT, encoded with the existingencode_viewer_context()helper. Sentry's middleware already accepts both formats (JWT first, fallback to legacy with signature), so the receiving side needs no change. The JWT also carries anexpclaim, which the legacy format didn't — strictly tighter than today.Seer just echoes whatever it got as a dict, so the single-header response works on the Seer side without any change there.
Tests: 5 new cases in
tests/sentry/seer/explorer/test_client_utils.py::TestGetProxyHeaderscovering no-VC, VC-without-user, no-shared-secret, single-header shape, and full JWT payload roundtrip.Refs RFC: Unified ViewerContext via ContextVar.