search

getsentry / sentry-docs

Sentry's documentation (and tools to build it)
https://docs.sentry.io
Other
337 stars 1.48k forks source link

Document `Allowed Domains` (and add note about local files) #4014

Open lobsterkatie opened 3 years ago

lobsterkatie commented 3 years ago

Core or SDK?

Core Sentry product

Which part? Which one?

Project settings

Description

This started with a question from a customer:

We found that some users save our site locally and when they open it api calls to our server fails but sentry server allows SDK to report the error although it shouldn't due to [the Allowed Domains setting]. This... has security consequences. For example we can see file path (with user name) that opened the local html file.

This happens because requests made from a raw html page have neither origin nor referer headers set, and therefore aren't subject to the Allowed Domains filter. Though this is fairly edge-case-y, it still might be worth adding a note to the docs about it.

(For this particular customer, likely the best solution is to check window.location.href and only call Sentry.init() if the protocol is http or https.)

Suggested Solution

1) Document the Allowed Domains setting.

2) Consider adding a note about all of the above.

imatwawana commented 3 years ago

@matejminar is this something I can assign to you?

matejminar commented 3 years ago

I have no context on this, but I am happy to apply any frontend changes we decide to do.

lobsterkatie commented 3 years ago

@imatwawana The first step here is to document the setting (in the docs or help center, not the product), so that we even have a place to think about sticking such a note. (I think it's enough of an edge case that it's not worth putting in the in-product help text.) I don't know who works on Settings documentation, if anyone, but they'd be the person to start with. Then we can talk about how common we think this question is and whether or not it's worth including an answer somewhere.

(This is low priority, IMHO, as I don't think many people run into this. It may be that the mere existence of this issue (so that if one googles "allowed domains sentry not working" or something, this comes up) is enough. )

getsantry[bot] commented 4 months ago

Routing to @getsentry/product-owners-settings-projects for triage ⏲️