feat(node): Add ignoreIncomingRequestBody callback to httpIntegration (#15959)

Allow ignoring the request body for certain requests, which is
very useful in situations of long-running requests with large/streaming
request bodies which can result in a lot of memory usage

---------

Co-authored-by: Lukas Stracke <lukas.stracke@sentry.io>

Author: Page-

dev-packages/node-integration-tests/suites/express/tracing/server.js

@@ -8,6 +8,16 @@ Sentry.init({
   tracePropagationTargets: [/^(?!.*test).*$/],
   tracesSampleRate: 1.0,
   transport: loggingTransport,
+  integrations: [
+    Sentry.httpIntegration({
+      ignoreIncomingRequestBody: (url) => {
+        if (url.includes('/test-post-ignore-body')) {
+          return true;
+        }
+        return false;
+      },
+    }),
+  ],
 });
 
 // express must be required after Sentry is initialized
@@ -43,6 +53,10 @@ app.post('/test-post', function (req, res) {
   res.send({ status: 'ok', body: req.body });
 });
 
+app.post('/test-post-ignore-body', function (req, res) {
+  res.send({ status: 'ok', body: req.body });
+});
+
 Sentry.setupExpressErrorHandler(app);
 
 startExpressServerAndSendPortToRunner(app);

dev-packages/node-integration-tests/suites/express/tracing/test.ts

@@ -1,5 +1,6 @@
 import { afterAll, describe, expect, test } from 'vitest';
 import { cleanupChildProcesses, createRunner } from '../../../utils/runner';
+import { assertSentryTransaction } from '../../../utils/assertions';
 
 describe('express tracing', () => {
   afterAll(() => {
@@ -244,6 +245,34 @@ describe('express tracing', () => {
         });
         await runner.completed();
       });
+
+      test('correctly ignores request data', async () => {
+        const runner = createRunner(__dirname, 'server.js')
+          .expect({
+            transaction: e => {
+              assertSentryTransaction(e, {
+                transaction: 'POST /test-post-ignore-body',
+                request: {
+                  url: expect.stringMatching(/^http:\/\/localhost:(\d+)\/test-post-ignore-body$/),
+                  method: 'POST',
+                  headers: {
+                    'user-agent': expect.stringContaining(''),
+                    'content-type': 'application/octet-stream',
+                  },
+                },
+              });
+              // Ensure the request body has been ignored
+              expect(e).have.property('request').that.does.not.have.property('data');
+            },
+          })
+          .start();
+
+        runner.makeRequest('post', '/test-post-ignore-body', {
+          headers: { 'Content-Type': 'application/octet-stream' },
+          data: Buffer.from('some plain text in buffer'),
+        });
+        await runner.completed();
+      });
     });
   });
 });

packages/node/src/integrations/http/SentryHttpInstrumentation.ts

@@ -58,6 +58,15 @@ export type SentryHttpInstrumentationOptions = InstrumentationConfig & {
    */
   ignoreOutgoingRequests?: (url: string, request: RequestOptions) => boolean;
 
+  /**
+   * Do not capture the request body for incoming HTTP requests to URLs where the given callback returns `true`.
+   * This can be useful for long running requests where the body is not needed and we want to avoid capturing it.
+   *
+   * @param url Contains the entire URL, including query string (if any), protocol, host, etc. of the outgoing request.
+   * @param request Contains the {@type RequestOptions} object used to make the outgoing request.
+   */
+  ignoreIncomingRequestBody?: (url: string, request: RequestOptions) => boolean;
+
   /**
    * Whether the integration should create [Sessions](https://docs.sentry.io/product/releases/health/#sessions) for incoming requests to track the health and crash-free rate of your releases in Sentry.
    * Read more about Release Health: https://docs.sentry.io/product/releases/health/
@@ -150,6 +159,7 @@ export class SentryHttpInstrumentation extends InstrumentationBase<SentryHttpIns
   ) => (this: unknown, event: string, ...args: unknown[]) => boolean {
     // eslint-disable-next-line @typescript-eslint/no-this-alias
     const instrumentation = this;
+    const { ignoreIncomingRequestBody } = instrumentation.getConfig();
 
     return (
       original: (event: string, ...args: unknown[]) => boolean,
@@ -171,7 +181,10 @@ export class SentryHttpInstrumentation extends InstrumentationBase<SentryHttpIns
         // request.ip is non-standard but some frameworks set this
         const ipAddress = (request as { ip?: string }).ip || request.socket?.remoteAddress;
 
-        patchRequestToCaptureBody(request, isolationScope);
+        const url = request.url || '/';
+        if (!ignoreIncomingRequestBody?.(url, request)) {
+          patchRequestToCaptureBody(request, isolationScope);
+        }
 
         // Update the isolation scope, isolate this request
         isolationScope.setSDKProcessingMetadata({ normalizedRequest, ipAddress });
@@ -180,7 +193,7 @@ export class SentryHttpInstrumentation extends InstrumentationBase<SentryHttpIns
         // Ideally, framework instrumentations coming after the HttpInstrumentation
         // update the transactionName once we get a parameterized route.
         const httpMethod = (request.method || 'GET').toUpperCase();
-        const httpTarget = stripUrlQueryAndFragment(request.url || '/');
+        const httpTarget = stripUrlQueryAndFragment(url);
 
         const bestEffortTransactionName = `${httpMethod} ${httpTarget}`;
 

packages/node/src/integrations/http/index.ts

@@ -73,6 +73,15 @@ interface HttpOptions {
    */
   ignoreIncomingRequests?: (urlPath: string, request: IncomingMessage) => boolean;
 
+  /**
+   * Do not capture the request body for incoming HTTP requests to URLs where the given callback returns `true`.
+   * This can be useful for long running requests where the body is not needed and we want to avoid capturing it.
+   *
+   * @param url Contains the entire URL, including query string (if any), protocol, host, etc. of the outgoing request.
+   * @param request Contains the {@type RequestOptions} object used to make the outgoing request.
+   */
+  ignoreIncomingRequestBody?: (url: string, request: RequestOptions) => boolean;
+
   /**
    * If true, do not generate spans for incoming requests at all.
    * This is used by Remix to avoid generating spans for incoming requests, as it generates its own spans.