feat(node): Add incoming request headers as OTel span attributes

.size-limit.js

@@ -233,7 +233,7 @@ module.exports = [
     import: createImport('init'),
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
-    limit: '152 KB',
+    limit: '154 KB',
   },
   {
     name: '@sentry/node - without tracing',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -78,6 +78,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
             'sentry.sample_rate': 1,
             'sentry.source': 'route',
             url: expect.stringContaining('/test-ssr'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
           op: 'http.server',
           origin: 'auto.http.astro',
@@ -223,6 +228,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/user-page/myUsername123'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -256,6 +266,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/api/user/myUsername123.json'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate',
+            'http.request.header.accept_language': '*',
+            'http.request.header.sec_fetch_mode': 'cors',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -308,6 +323,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -360,6 +380,11 @@ test.describe('parametrized vs static paths', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/user-page/settings'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -79,6 +79,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
             'sentry.sample_rate': 1,
             'sentry.source': 'route',
             url: expect.stringContaining('/test-ssr'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
           op: 'http.server',
           origin: 'auto.http.astro',
@@ -226,6 +231,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/user-page/myUsername123'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -259,6 +269,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/api/user/myUsername123.json'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate',
+            'http.request.header.accept_language': '*',
+            'http.request.header.sec_fetch_mode': 'cors',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -311,6 +326,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/catchAll/hell0/whatever-do'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },
@@ -363,6 +383,11 @@ test.describe('parametrized vs static paths', () => {
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
             url: expect.stringContaining('/user-page/settings'),
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'navigate',
+            'http.request.header.user_agent': expect.any(String),
           },
         },
       },

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -70,6 +70,11 @@ test.describe('tracing in static routes with server islands', () => {
             'sentry.op': 'http.server',
             'sentry.origin': 'auto.http.astro',
             'sentry.source': 'route',
+            'http.request.header.accept': expect.any(String),
+            'http.request.header.accept_encoding': 'gzip, deflate, br, zstd',
+            'http.request.header.accept_language': 'en-US',
+            'http.request.header.sec_fetch_mode': 'cors',
+            'http.request.header.user_agent': expect.any(String),
           }),
           op: 'http.server',
           origin: 'auto.http.astro',

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
   const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+  const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+  // Outgoing span (`http.client`) does not include headers as attributes
+  expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
   expect(traceId).toEqual(expect.any(String));
 
   // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-outgoing-http/:id',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-inbound-headers/:id',
+      'http.request.header.baggage': expect.any(String),
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
     },
     op: 'http.server',
     parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
   const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+  const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+  // Outgoing span (`http.client`) does not include headers as attributes
+  expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
   expect(traceId).toEqual(expect.any(String));
 
   // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-outgoing-fetch/:id',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/example-module/transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/example-module/transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

dev-packages/e2e-tests/test-applications/nextjs-15/package.json

@@ -6,6 +6,7 @@
     "build": "next build > .tmp_build_stdout 2> .tmp_build_stderr || (cat .tmp_build_stdout && cat .tmp_build_stderr && exit 1)",
     "clean": "npx rimraf node_modules pnpm-lock.yaml .tmp_dev_server_logs",
     "test:prod": "TEST_ENV=production playwright test",
+    "test:prod-turbo": "TEST_ENV=prod-turbopack playwright test",
     "test:dev": "TEST_ENV=development playwright test",
     "test:dev-turbo": "TEST_ENV=dev-turbopack playwright test",
     "test:build": "pnpm install && pnpm build",
@@ -46,7 +47,7 @@
       },
       {
         "build-command": "pnpm test:build-turbo",
-        "assert-command": "pnpm test:prod && pnpm test:dev-turbo",
+        "assert-command": "pnpm test:prod-turbo && pnpm test:dev-turbo",
         "label": "nextjs-15 (turbo)"
       }
     ]

dev-packages/e2e-tests/test-applications/nextjs-15/playwright.config.mjs

@@ -14,7 +14,7 @@ const getStartCommand = () => {
     return 'pnpm next dev -p 3030 2>&1 | tee .tmp_dev_server_logs';
   }
 
-  if (testEnv === 'production') {
+  if (testEnv === 'production' || testEnv === 'prod-turbopack') {
     return 'pnpm next start -p 3030';
   }
 

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,38 @@ test('App router transactions should be attached to the pageload request span',
   expect(pageloadTraceId).toBeTruthy();
   expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+  test.skip(
+    process.env.TEST_ENV === 'prod-turbopack' || process.env.TEST_ENV === 'dev-turbopack',
+    'Incoming fetch request headers are not added as span attributes when Turbopack is enabled (addHeadersAsAttributes)',
+  );
+
+  const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+    return transactionEvent?.transaction === 'GET /pageload-tracing';
+  });
+
+  await fetch(`${baseURL}/pageload-tracing`, {
+    headers: {
+      'User-Agent': 'Custom-NextJS-Agent/15.0',
+      'Content-Type': 'text/html',
+      'X-NextJS-Test': 'nextjs-header-value',
+      Accept: 'text/html, application/xhtml+xml',
+      'X-Framework': 'Next.js',
+      'X-Request-ID': 'nextjs-789',
+    },
+  });
+
+  const serverTransaction = await serverTransactionPromise;
+
+  expect(serverTransaction.contexts?.trace?.data).toEqual(
+    expect.objectContaining({
+      'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+      'http.request.header.content_type': 'text/html',
+      'http.request.header.x_nextjs_test': 'nextjs-header-value',
+      'http.request.header.accept': 'text/html, application/xhtml+xml',
+      'http.request.header.x_framework': 'Next.js',
+      'http.request.header.x_request_id': 'nextjs-789',
+    }),
+  );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),