feat(core)!: Gate incoming HTTP body capture on dataCollection.httpBodies

Author: s1gr1d

packages/cloudflare/src/integrations/httpServer.ts

@@ -42,14 +42,14 @@ export interface HttpServerIntegrationOptions {
 
 interface HttpServerIntegrationInstance {
   name: string;
-  maxRequestBodySize: MaxRequestBodySize;
+  maxRequestBodySize: MaxRequestBodySize | undefined;
   ignoreRequestBody?: (url: string, request: Request) => boolean;
 }
 
 const _httpServerIntegration = ((options: HttpServerIntegrationOptions = {}): HttpServerIntegrationInstance => {
   return {
     name: INTEGRATION_NAME,
-    maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
+    maxRequestBodySize: options.maxRequestBodySize,
     ignoreRequestBody: options.ignoreRequestBody,
   };
 }) satisfies IntegrationFn;
@@ -85,11 +85,12 @@ export async function captureIncomingRequestBody(client: Client, request: Reques
     return;
   }
 
-  // TODO(v11): Gate incoming request body capture on `dataCollection.httpBodies` (capture only when
-  // `'incomingRequest'` is listed) instead of defaulting to `'medium'`.
-  const maxRequestBodySize = integration.maxRequestBodySize;
+  const configuredBodySize = integration.maxRequestBodySize;
+  const effectiveBodySize: MaxRequestBodySize =
+    configuredBodySize ??
+    (client.getDataCollectionOptions().httpBodies.includes('incomingRequest') ? 'medium' : 'none');
 
-  if (maxRequestBodySize === 'none') {
+  if (effectiveBodySize === 'none') {
     return;
   }
 
@@ -104,5 +105,5 @@ export async function captureIncomingRequestBody(client: Client, request: Reques
   }
 
   const isolationScope = getIsolationScope();
-  await captureBodyFromWinterCGRequest(request, isolationScope, maxRequestBodySize);
+  await captureBodyFromWinterCGRequest(request, isolationScope, effectiveBodySize);
 }

packages/cloudflare/test/request.test.ts

@@ -8,6 +8,7 @@ import { beforeAll, beforeEach, describe, expect, onTestFinished, test, vi } fro
 import { setAsyncLocalStorageAsyncContextStrategy } from '../src/async';
 import type { CloudflareOptions } from '../src/client';
 import { CloudflareClient } from '../src/client';
+import { httpServerIntegration } from '../src/integrations/httpServer';
 import { wrapRequestHandler } from '../src/request';
 
 const MOCK_OPTIONS: CloudflareOptions = {
@@ -206,18 +207,14 @@ describe('withSentry', () => {
       expect(sentryEvent.contexts?.culture).toEqual({ timezone: 'UTC' });
     });
 
-    // TODO(v11): Body capture should be gated on `dataCollection.httpBodies` (only capture when
-    // `'incomingRequest'` is listed). Until then we keep the historical behavior of capturing
-    // incoming request bodies by default at `'medium'`, consistent with the Node SDK.
-    test('captures request body with default integration (medium size)', async () => {
+    test('captures request body by default (all body types included by default)', async () => {
       let sentryEvent: Event = {};
       const context = createMockExecutionContext();
 
       await wrapRequestHandler(
         {
           options: {
             ...MOCK_OPTIONS,
-            // Default integrations include httpServerIntegration with 'medium' default
             beforeSend(event) {
               sentryEvent = event;
               return null;
@@ -241,6 +238,69 @@ describe('withSentry', () => {
       );
     });
 
+    test('does not capture request body when dataCollection.httpBodies excludes incomingRequest', async () => {
+      let sentryEvent: Event = {};
+      const context = createMockExecutionContext();
+
+      await wrapRequestHandler(
+        {
+          options: {
+            ...MOCK_OPTIONS,
+            dataCollection: { httpBodies: [] },
+            beforeSend(event) {
+              sentryEvent = event;
+              return null;
+            },
+          },
+          request: new Request('https://example.com', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ username: 'test', data: 'value' }),
+          }),
+          context,
+        },
+        () => {
+          SentryCore.captureMessage('request body');
+          return new Response('test');
+        },
+      );
+
+      expect(sentryEvent.sdkProcessingMetadata?.normalizedRequest?.data).toBeUndefined();
+    });
+
+    test('explicit maxRequestBodySize overrides dataCollection.httpBodies', async () => {
+      let sentryEvent: Event = {};
+      const context = createMockExecutionContext();
+
+      await wrapRequestHandler(
+        {
+          options: {
+            ...MOCK_OPTIONS,
+            integrations: [
+              // httpBodies not set → would default to 'none', but explicit override wins
+              httpServerIntegration({ maxRequestBodySize: 'medium' }),
+            ],
+            beforeSend(event) {
+              sentryEvent = event;
+              return null;
+            },
+          },
+          request: new Request('https://example.com', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ key: 'value' }),
+          }),
+          context,
+        },
+        () => {
+          SentryCore.captureMessage('request body');
+          return new Response('test');
+        },
+      );
+
+      expect(sentryEvent.sdkProcessingMetadata?.normalizedRequest?.data).toEqual(JSON.stringify({ key: 'value' }));
+    });
+
     // TODO(v11): Cookies should be attached (subject to denylist filtering) by default. Until then we keep the
     // historical Cloudflare behavior of not attaching cookies unless the user explicitly opts in.
     test('does not capture cookies by default', async () => {

packages/core/src/integrations/http/server-subscription.ts

@@ -108,14 +108,18 @@ export function instrumentServer(options: HttpInstrumentationOptions, server: Ht
       const url = request.url || '/';
       const normalizedRequest = httpRequestToRequestData(request);
       const {
-        maxRequestBodySize = 'medium',
+        maxRequestBodySize: configuredBodySize,
         ignoreRequestBody,
         sessions = true,
         sessionFlushingDelayMS = 60_000,
       } = options;
 
-      if (maxRequestBodySize !== 'none' && !ignoreRequestBody?.(url, request)) {
-        patchRequestToCaptureBody(request, isolationScope, maxRequestBodySize, INTEGRATION_NAME);
+      const effectiveBodySize =
+        configuredBodySize ??
+        (client.getDataCollectionOptions().httpBodies.includes('incomingRequest') ? 'medium' : 'none');
+
+      if (effectiveBodySize !== 'none' && !ignoreRequestBody?.(url, request)) {
+        patchRequestToCaptureBody(request, isolationScope, effectiveBodySize, INTEGRATION_NAME);
       }
 
       // Update the isolation scope, isolate this request

packages/deno/src/integrations/http.ts

@@ -99,7 +99,7 @@ const _denoHttpIntegration = ((options: DenoHttpIntegrationOptions = {}) => {
         spans: options.spans,
         ignoreStaticAssets: options.ignoreStaticAssets,
         ignoreIncomingRequests: options.ignoreIncomingRequests,
-        maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
+        maxRequestBodySize: options.maxRequestBodySize,
         ignoreRequestBody: options.ignoreRequestBody,
         onSpanCreated: options.onIncomingSpanCreated,
         onSpanEnd: options.onIncomingSpanEnd,

packages/node/src/integrations/http/httpServerIntegration.ts

@@ -83,7 +83,7 @@ const _httpServerIntegration = ((options: HttpServerIntegrationOptions = {}) =>
   const _options = {
     sessions: options.sessions ?? true,
     sessionFlushingDelayMS: options.sessionFlushingDelayMS ?? 60_000,
-    maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
+    maxRequestBodySize: options.maxRequestBodySize,
     // Server spans are created by `httpServerSpansIntegration` via the
     // `httpServerRequest` client event + `_startSpanCallback`, not by the
     // core subscription helper. Explicitly opt out so the helper does not