Repository navigation
feat(nextjs): Emit the tunnel route handler - #25424
Merged
Merged
Conversation
Contributor
size-limit report 📦Compared: 02b3743 (PR test merge using develop at 1873c1d) Against: 1873c1d (develop) · base run #65687 ✅ Baseline matches: this diff contains only this PR's changes.
|
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 01:51
0bd8edd to
a0d5655
Compare
Member
Author
|
bugbot run |
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 02:25
a0d5655 to
bff33ce
Compare
Member
Author
|
bugbot run |
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 03:32
bff33ce to
61392db
Compare
Member
Author
|
bugbot run |
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 04:23
5472088 to
ae51678
Compare
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 04:48
ae51678 to
9c50125
Compare
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 14:00
9c50125 to
e94f25d
Compare
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 14:37
e94f25d to
efc9b07
Compare
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 16:15
efc9b07 to
2e8e2b3
Compare
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 16, 2026 17:56
2e8e2b3 to
2c6c3d8
Compare
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
logaretm
force-pushed
the
awad/tunnel-nextjs
branch
from
October 28, 2026 17:57
5bc562c to
ef27f39
Compare
Contributor
Optional E2E testsSome optional checks were not successful. They do not block the merge. 4 not successful, 53 successful. See the run.
Successful checks
|
Contributor
|
One or more gzipped bundles increased by more than 500 bytes. If this increase is intentional, add the Accept Bundlesize Increase label to this PR to rerun and accept the check. |
…equest` The tunnel route handler now leaves DSN normalization, the allowlist and tracing suppression to core. As in every other SDK, `allowedDsns` adds to the server's own DSN, and the default `POST` accepts the DSNs `serveTunnelIntegration` allows.
…ePath` `tunnel: true` in the browser now sends to `<basePath>/<hash>`, like the SvelteKit and React Router SDKs do with their base paths. A `basePath` the user set and a `tunnel` URL stay as written.
…the server `withSentryConfig` now injects `basePath` into production server and edge builds, not only in dev, and the server, edge and Cloudflare inits pass it to `setManagedTunnelDefaults`. `serveTunnelIntegration` then matches `/<basePath>/<hash>`, like the browser sends.
Vercel serves unknown paths from its CDN without running the app, so the runtime never sees managed tunnel requests there. On Vercel builds without `tunnelRoute`, `withSentryConfig` writes the tunnel route handler and rewrites envelope requests to the DSN-derived paths there. The handler answers only when `serveTunnelIntegration` is set up, and on a cold start too. Pages Router apps get an `app` directory with only this route.
`tunnel: true` in the browser and `serveTunnelIntegration` on the server serve the tunnel on every Next.js deployment, so `tunnelRoute` and the `@sentry/nextjs/tunnel` route handlers are deprecated. `withSentryConfig` warns when `tunnelRoute` is set.
With `trailingSlash: true` Next redirected the browser's POST to the tunnel path without the slash.
s1gr1d
reviewed
Nov 11, 2026
…and preview builds
The deprecated `tunnelRoute` now turns on the managed tunnel, like `tunnel: true` with `serveTunnelIntegration()`: a string is its fixed path, `true` the path derived from the DSN. The proxy rewrite to sentry.io, which forwarded every header including cookies, and the handler mode rewrite are gone. On Vercel, the generated route also serves the fixed path.
The route `withSentryConfig` generates on Vercel re-exports it, so it stays.
…ercel tunnel route A fixed tunnel `path` set in `Sentry.init` now reaches the route on Vercel too, without `tunnelRoute`. The envelope content type keeps other requests out, and the handler forwards only envelopes for allowed DSNs.
…t type The browser sends `application/x-sentry-envelope` only for a managed tunnel given as `true` or options. A fixed path injected as a string went out as `text/plain`, which the Vercel rewrite doesn't match.
…erived from the DSN The Next.js span filters only knew a fixed `tunnelRoute` path, and the `url.path` filters of the managed tunnel don't match Next.js request spans, which carry only `http.target` at start. A proxy that runs outside of the server, like on Vercel, sent its spans of tunnel requests. The filters now come from the paths the client serves.
s1gr1d
approved these changes
Nov 11, 2026
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a128721. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This overhauls the tunnel implementation of Next.js by doing a few things:
omitfor the transport options.The way it works varies depeding on how the user deploys their application.
On Conventional Servers/Platforms
Our runtime patchers introduced in this stack handle the tunnel request, the user's Next.js app never handles any of these.
On Vercel
We utilize the two-hop idea we did in #25456 by writing a small idempotent app router file. The re-write rules move traffic to the new handler, and the file exports a
POSThandler for the route.Vercel applies certain rules and responds with 404 for tunnel requests that aren't present in re-writes or app router, so our runtime patchers will never trigger. Which is why this workaround was needed.
For everyone else, the runtime patchers will work.