Sentry alters config object passed to init.

[andrnag]

• [x] Review the documentation: https://docs.sentry.io/
• [x] Search for existing issues: https://github.com/getsentry/sentry-javascript/issues
• [x] Use the latest release: https://github.com/getsentry/sentry-javascript/releases
• [ ] Provide a link to the affected event from your Sentry account

Package + Version

• [x] @sentry/browser
• [x] @sentry/node
• [ ] raven-js
• [ ] raven-node (raven for node)
• [ ] other:

Version:

5.12.0

Description

Sentry.init alters config object. It can lead to problems if the same config used on the backend and the frontend. The common practice is to copy config objects before using it in the library.

[vvolodko]

The Sentry.init() function inserts defaultIntegrations and release keys into passed options object.

Attached archive (sentry.zip) contains simplified example of backend/frontend project wich shows the impact.

Try run

$ yarn dev
$ curl localhost:8080/a/b/c   # in another console

[vvolodko]

The same is true for @sentry/browser:

export function init(options: BrowserOptions = {}): void {
  if (options.defaultIntegrations === undefined) {
    options.defaultIntegrations = defaultIntegrations;
  }
  if (options.release === undefined) {
    const window = getGlobalObject<Window>();
    // This supports the variable that sentry-webpack-plugin injects
    if (window.SENTRY_RELEASE && window.SENTRY_RELEASE.id) {
      options.release = window.SENTRY_RELEASE.id;
    }
  }
  initAndBind(BrowserClient, options);
}

[rhcarvalho]

Sentry.init alters config object. It can lead to problems if the same config used on the backend and the frontend. The common practice is to copy config objects before using it in the library.

I have the impression that by design the SDK "owns" the config after it is passed to Sentry.init. Need to confirm it with the team.

That's the case for other SDKs. Python's config object has references to mutable objects, all occurrences of [] and {} in sentry_sdk/consts.py#L47-L68 would be compromised if configs were reused. Go SDK also assumes ownership of the config passed as a pointer.

From what I've seen, user code should not be altering config after init (undefined behavior), nor re-using configs.

In JavaScript there is no way to enforce object ownership, but it could be explicitly documented if necessary.

For simple cases like in @vvolodko's example, a shallow copy of the shared config could be effectively used to avoid keeping a reference to objects whose ownership is transferred to the SDK, see diff below.

A more general use case would have different configs for frontend and backend, different DSNs, etc, so all this copying wouldn't be a thing.

Code from @vvolodko

## index.js ```js const express = require('express'); const Sentry = require('@sentry/node'); const config = { app: { port: 8080, }, sentry: { dsn: 'https://dummy@sentry.test/0000000', environment: 'testing', }, }; /* * Initialize @sentry/node at backend. * This will modify config.sentry object, see below. */ Sentry.init(config.sentry); const app = express(); app.use(Sentry.Handlers.requestHandler()); /* * Render frontend content. */ const render = (initialState, req) => { return `

You are visiting: ${req.url}

`; }; app.get('*', (req, res) => { const initialState = { sentry: config.sentry, }; res.set('Content-Type', 'text/html'); res.send(render(initialState, req)); }); app.use(Sentry.Handlers.errorHandler()); app.listen(config.app.port, () => { console.log(`App is running on port: ${config.app.port}`); }); ``` ## package.json ```json { "name": "sentry-init-bug-demo", "version": "1.0.0", "main": "index.js", "license": "MIT", "private": true, "scripts": { "dev": "nodemon -w . index.js" }, "dependencies": { "@sentry/node": "^5.12.1", "express": "^4.17.1" }, "devDependencies": { "nodemon": "^2.0.2" } } ```

diff --git a/index.js b/index.js
index 4bad9f2..fa5c4fc 100644
--- a/index.js
+++ b/index.js
@@ -15,7 +15,7 @@ const config = {
  * Initialize @sentry/node at backend.
  * This will modify config.sentry object, see below.
  */
-Sentry.init(config.sentry);
+Sentry.init({...config.sentry});

 const app = express();
 app.use(Sentry.Handlers.requestHandler());
@@ -50,7 +42,7 @@ const render = (initialState, req) => {

 app.get('*', (req, res) => {
     const initialState = {
-        sentry: config.sentry,
+        sentry: {...config.sentry},
     };
     res.set('Content-Type', 'text/html');
     res.send(render(initialState, req));

[github-actions[bot]]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[rhcarvalho]

Closing as stale.