chore: filter out more 404s for Sentry (#2257)

* chore: filter out 404s which triggered SecurityErrors by also doing host poisoning

Signed-off-by: Nicolas Höning <nicolas@seita.nl>

* PR number in changelog

Signed-off-by: Nicolas Höning <nicolas@seita.nl>

* remove unused imports

Signed-off-by: Nicolas Höning <nicolas@seita.nl>

* Update flexmeasures/utils/app_utils.py

Co-authored-by: Felix Claessen <30658763+Flix6x@users.noreply.github.com>
Signed-off-by: Nicolas Höning <iam@nicolashoening.de>

* remove whitelist and simplify what we catch, also add more explanation

Signed-off-by: Nicolas Höning <nicolas@seita.nl>

---------

Signed-off-by: Nicolas Höning <nicolas@seita.nl>
Signed-off-by: Nicolas Höning <iam@nicolashoening.de>
Signed-off-by: Felix Claessen <30658763+Flix6x@users.noreply.github.com>
Co-authored-by: Felix Claessen <30658763+Flix6x@users.noreply.github.com>

Author: nhoening

documentation/changelog.rst

@@ -4,6 +4,7 @@ FlexMeasures Changelog
 **********************
 
 
+
 v1.0.0 | July XX, 2026
 ============================
 
@@ -35,9 +36,17 @@ Bugfixes
 
 v0.33.1 | July XX, 2026
 ============================
+
+Bugfixes
+-----------
 * Allow flex-model and flex-context to be missing from scheduling requests, because by now the whole flex-config can be defined on assets (in the db) instead [see `PR #2237 <https://www.github.com/FlexMeasures/flexmeasures/pull/2237>`_]
 * Fix Chart Point sessions chart [see `PR #2259 <https://www.github.com/FlexMeasures/flexmeasures/pull/2259>`_]
 
+Infrastructure / Support
+------------------------
+* Filter handled untrusted-host ``SecurityError`` events out of Sentry, alongside the existing 404 filtering [see `PR #2257 <https://www.github.com/FlexMeasures/flexmeasures/pull/2257>`_]
+
+
 
 v0.33.0 | June 1, 2026
 ============================

flexmeasures/utils/app_utils.py

@@ -28,21 +28,37 @@ def flexmeasures_cli():
     pass
 
 
+# For the Sentry integration, a crucial task is to filter out noise before it reaches Sentry.
+# Limiting what gets sent to Sentry (by 95%) keeps your costs to what you are interested in.
+# We want to filter out 404s (also those who in addition use untrusted-host request headers),
+# which are common probes in the wild.
+# Note: errors may reach Sentry twice - as raised Exception plus if FlexMeasures logs the error (e.g. during handling it)
+#       With verbose=False, Sentry might only see the  logging event, not an Exception, as it is only visible in the LogRecord message rather than in hint["exc_info"].
+
+
 def _sentry_filter_notfound(event, hint):
-    """Filter out 404 Not Found errors to avoid inflating Sentry error budgets."""
+    """Filter out noisy handled web errors to avoid inflating Sentry error budgets."""
     if "exc_info" in hint:
-        exc_type, exc_value, _tb = hint["exc_info"]
+        _exc_type, exc_value, _tb = hint["exc_info"]
         if isinstance(exc_value, NotFound):
             return None
     # FlexMeasures logs handled 404s with verbose=False to keep automated
     # scans for hackable URLs from overwhelming log files. Sentry receives
     # those as logging events, so the NotFound exception is only visible in
     # the LogRecord message rather than in hint["exc_info"].
+    # We also filter out handled SecurityErrors that are logged when untrusted-host
+    # request headers are used.
     log_record = hint.get("log_record")
     if log_record is not None:
         message = log_record.getMessage()
         if message.startswith("NotFound - URL was: "):
             return None
+        if (
+            message.startswith("SecurityError - URL was: ")
+            and " - \"Host '" in message
+            and message.endswith("' is not trusted.\"")
+        ):
+            return None
     return event
 
 

flexmeasures/utils/tests/test_app_utils.py

@@ -4,7 +4,7 @@
 from flask import Flask
 from sentry_sdk.integrations.flask import FlaskIntegration
 from sentry_sdk.transport import Transport
-from werkzeug.exceptions import InternalServerError, NotFound
+from werkzeug.exceptions import InternalServerError, NotFound, SecurityError
 
 from flexmeasures.utils.app_utils import _sentry_filter_notfound
 from flexmeasures.utils.error_utils import add_basic_error_handlers
@@ -47,6 +47,17 @@ def test_sentry_filter_passes_other_errors():
     assert _sentry_filter_notfound(event, hint) is event
 
 
+def test_sentry_filter_drops_untrusted_host_security_error():
+    """Untrusted-host SecurityErrors with exc_info should still be reported."""
+    event = {"message": "Security Error"}
+    hint = make_hint(
+        SecurityError(
+            "Host 'static.152.131.199.138.clients.your-server.de' is not trusted."
+        )
+    )
+    assert _sentry_filter_notfound(event, hint) is event
+
+
 def test_sentry_filter_passes_events_without_exc_info():
     """Events without exc_info (e.g. captured messages) should be passed through."""
     event = {"message": "some log message"}
@@ -70,6 +81,16 @@ def test_sentry_filter_passes_other_log_records():
     assert _sentry_filter_notfound(event, hint) is event
 
 
+def test_sentry_filter_drops_untrusted_host_security_error_log_record():
+    """Handled untrusted-host SecurityErrors are logged without exc_info."""
+    event = {"message": "Security Error"}
+    log_record = app_logger_record(
+        "SecurityError - URL was: /admin/config.php - \"Host '0.0.0.0' is not trusted.\""
+    )
+    hint = {"log_record": log_record}
+    assert _sentry_filter_notfound(event, hint) is None
+
+
 def test_sentry_filter_drops_flask_404_logging_event():
     """The Flask error handler logs 404s with a LogRecord hint."""
     app = Flask(__name__)