feat(replay): Adding OkHttp Request/Response bodies #4796

43jay · 2025-10-09T21:27:58Z

📜 Description

Initalise DefaultReplayBreadcrumbConverter as the SDK-wide BeforeBreadcrumbCallback. It is responsible for delegating to a user-provided BeforeBreadcrumb.

Introduce new utility/data classes (io.sentry.util.network pkg), following format in the javascript SDK.

In BeforeBreadcrumb, NetworkDetailCaptureUtils extracts 'Network Details' data objects (NetworkRequestData, ReplayNetworkRequestOrResponse) and inserts back into the breadcrumb Hint (only sentry-okhttp for now).

When converting Breadcrumb to RRWebSpanEvent, extract NetworkRequestData data from Hint (name="replay:networkDetails") and insert into the replay performanceSpan when creating the replay segment.

TODOs

Feedback:

Are we handling 'enough' body types? Given there are so many diff types of request bodies ->
Current impl handles JSON, UrlFormEncoded, skips these binary content types, and falls back to raw String as possible
Decide on keeping changes to sentry-samples-android
Will this work when the gradle plugin is used to add the SentryOkHttpInterceptor? This code implies we only send the breadcrumb w/ network details when that path isn't active.

Implementation:

Restrict size of breadcrumbsMap entries after data has been added to replay
Respect networkDetail* SDK Options flags
- Will handle in a Future PR
handle case where SentryOkHttpEventListener handles http request instrumentation
- Will handle in a Future PR
Unit tests

Pre-Land:

Go through commits and remove any testing-oriented ones
- Remove FAKE_OPTIONS in SentryOkHttpInterceptor before landing // there for testing
Remove remaining unnecessary debug log statements

💡 Motivation and Context

Part of [Mobile Replay] Capture Network request/response bodies

Initially, we were trying to keep SDK changes simple and re-use the existing OKHTTP_REQUEST|RESPONSE hint data.
However, the :sentry-android-replay gradle module doesn't compile against any of the http libs (makes sense).

Because these okhttp3.Request, etc types don't exist in :sentry-android-replay, replay accesses the NetworkDetails data via Hint data ("replay:networkDetails") on the Breadcrumb, when the SDKOptions constraints have been met.

💚 How did you test it?

this replay session is an example recording with no networkDetail* SDK options enabled
(replay sessions below were captured without commit 4bc5b7714).

recording segment data shows sample replay payload .

replay session respects networkDetail[Request|Response]Headers

https://sentry-sdks.sentry.io/explore/replays/f89535ea0e79499ca8d75e34e6270925

replay session captures GET request bodies as null

replay session

replay session captures JSON bodies

1. Request body formatted as JSON key/values
ref

2. Response body formatted as JSON key/values
ref

replay session captures plaintext bodies

replay session

replay session captures form bodies (formurlencoded)

replay session

replay session captures binary bodies

1. binary body under size limit (valid response size; summarized body content

https://sentry-sdks.sentry.io/explore/replays/baf899dd12c14718bc5d8b877a9fff3d

2. binary body over size limit (invalid response size, summarized body content
(https://sentry-sdks.sentry.io/explore/replays/94dc96ae2b8c4f4d8c23e2e0c69e5d1d)

replay session truncates plaintext bodies over 150KB (`MAX_NETWORK_BODY_SIZE`)

https://sentry-sdks.sentry.io/explore/replays/e11711a70c164a8fa1a2ed39e8632a05

replay sessions properly capture one-shot okhttp request bodies

One-shot HTTP Request Body request

Test: read(..) okhttp3.Request.body in an OkHttpInterceptor after cloning body into new request causes the request to succeed ✅ (current impl)

replay session

Valid response body logged to sentry:

Sanity Test: read(..) okhttp3.Request.body in an OkHttpInterceptor without cloning body into a new request causes the request to fail ✅

replay session

Invalid response body logged to sentry:

https://sentry-sdks.sentry.io/settings/projects/sentry-android/keys/

…dcrumbCallback to extract NetworkRequestData from Hint -> NetworkRequestData is landing on DefaultReplayBreadcrumbConverter via Hint.get(replay:networkDetails)

linear · 2025-10-09T21:28:02Z

MOBILE-935 [Mobile Replay] Capture Network request/response bodies

...ry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt

seer-by-sentry · 2025-10-09T21:33:48Z

sentry-android-core/src/main/java/io/sentry/android/core/AndroidOptionsInitializer.java

+      options.setBeforeBreadcrumb(
+        replayBreadcrumbConverter
+      );


Potential bug: A user-configured BeforeBreadcrumbCallback overwrites the SDK's replay converter during initialization, silently disabling network capture for replays.

Description: During SentryAndroid.init(), the DefaultReplayBreadcrumbConverter is set as the BeforeBreadcrumbCallback before the user's configuration callback is executed. If a user provides their own BeforeBreadcrumbCallback in the configuration, it replaces the SDK's converter. This breaks the replay feature's ability to capture network request data, as the logic in DefaultReplayBreadcrumbConverter is never called. The feature fails silently for any user following the common practice of setting a breadcrumb callback.

Suggested fix: Modify the initialization logic to chain the callbacks instead of overwriting. The DefaultReplayBreadcrumbConverter should be initialized with the user's callback, which is retrieved after the user's configuration has run. The converter would then execute the user's callback before its own logic.
_{severity: 0.7, confidence: 0.99}

_{Did we get this right? 👍 / 👎 to inform future reviews.}

this is legit, so we probably have to move setting the beforeBreadcrumb callback over to initializeIntegrationsAndProcessors which is called after the user config. You can access the converter via options.getReplayController().getBreadcrumbConverter later on

nice one 🙈 thanks

romtsn · 2025-10-13T09:58:12Z

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt

 import io.sentry.util.SpanUtils
 import io.sentry.util.TracingUtils
 import io.sentry.util.UrlUtils
+import io.sentry.util.network.NetworkRequestData


these are missing from the PR, but I assume they are just data holders so nothing fancy there :)

romtsn · 2025-10-13T09:58:42Z

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt

+      val networkData = createNetworkRequestData(request, response, requestBodySize, responseBodySize)
+      it.set("replay:networkDetails", networkData)
+
+//      it.set(OKHTTP_REQUEST, request)


we should probably still keep these because some of our customer may rely on them being present in the hint

romtsn · 2025-10-13T10:07:46Z

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt

+
+  /**
+   * Extracts body metadata from OkHttp RequestBody or ResponseBody
+   * Note: We don't consume the actual body stream to avoid interfering with the request/response


hm, is it not possible to consume/copy it? I think would be great if we could do that, given that the JS sdk does that too. Otherwise, it's probably not very helpful to just have the headers and some metadata

fixed, but need to do some more testing

fixed by copying out the body and creating a new request when networkCaptureBodies is true

romtsn · 2025-10-13T10:08:57Z

...ry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt

+    // First try to get the structured network data from the hint
+    val networkDetails = breadcrumbHint.get("replay:networkDetails") as? NetworkRequestData
+    if (networkDetails != null) {
+      Log.d("SentryNetwork", "SentryNetwork: Found structured NetworkRequestData in hint: $networkDetails")


I guess you're gonna clean these up, but if you wanna keep some logs please use options.logger as it will no-op in production builds

cleaned up most, left in the rest to help with debugging. will remove / clean-up before landing (added to TODOs)

fixed. all unnecessary logs should be gone so lemme know if u see any i missed

These get set on the breadcrumb Hint, and then hang around in DefaultReplayBreadcrumbConverter until the replay segment has been sent off See https://github.com/getsentry/sentry-javascript/blob/632f0b953d99050c11b0edafb9f80b5f3ba88045/packages/replay-internal/src/types/performance.ts#L133-L140 https://github.com/getsentry/sentry-javascript/blob/develop/packages/replay-internal/src/types/request.ts#L12

Manually set networkDetailHasUrls to pass this check https://github.com/getsentry/sentry-javascript/blob/d1646c8a281dd8795c5a6a3b8e18f2e7069e7fa9/packages/replay-internal/src/util/handleRecordingEmit.ts#L134 https://github.com/getsentry/sentry/blob/master/static/app/views/replays/detail/network/details/getOutputType.tsx#L33 https://github.com/getsentry/sentry/blob/master/static/app/views/replays/detail/network/details/content.tsx#L55-L56

added some unit tests: ./gradlew :sentry-android-replay:testDebugUnitTest --tests="*DefaultReplayBreadcrumbConverterTest*"

Breadcrumb.java has several timestamp fields: `timestamp: Date`, `timestampMs: Long`, `nanos: Long` `hashcode` was relying solely on `timestamp`, which can be null depending on which constructor was used. => Change to use getTimestamp as 1. this is what equals does (consistency) 2. getTimestamp initialises timestamp if null.

sentry/src/main/java/io/sentry/rrweb/RRWebOptionsEvent.java

seer-by-sentry · 2025-10-24T15:53:09Z

...ry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt

+  private val httpNetworkDetails =
+    Collections.synchronizedMap(
+      object : LinkedHashMap<Breadcrumb, NetworkRequestData>() {
+        override fun removeEldestEntry(
+          eldest: MutableMap.MutableEntry<Breadcrumb, NetworkRequestData>?
+        ): Boolean {
+          return size > MAX_HTTP_NETWORK_DETAILS
+        }
+      }
+    )


Bug: Breadcrumb.equals() omits data map, causing HashMap key collisions for concurrent requests, leading to incorrect network data attribution.
_{Severity: CRITICAL | Confidence: 1.00}

🔍 Detailed Analysis

The Breadcrumb.equals() method omits the data map from its comparison. This allows distinct Breadcrumb objects, particularly those generated by HTTP requests occurring within the same millisecond but having different URLs or other data map contents, to be considered equal. When these Breadcrumb objects are used as keys in the httpNetworkDetails LinkedHashMap, one entry can unintentionally overwrite another, causing network details from one request to be incorrectly associated with a different request during session replay processing.

💡 Suggested Fix

Modify Breadcrumb.equals() to include the data map in its comparison, or use a different key for httpNetworkDetails that uniquely identifies each network request, such as a UUID or a composite key including relevant data fields.

🤖 Prompt for AI Agent

Fix this bug. In sentry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt at lines 33-42: The `Breadcrumb.equals()` method omits the `data` map from its comparison. This allows distinct `Breadcrumb` objects, particularly those generated by HTTP requests occurring within the same millisecond but having different URLs or other `data` map contents, to be considered equal. When these `Breadcrumb` objects are used as keys in the `httpNetworkDetails` `LinkedHashMap`, one entry can unintentionally overwrite another, causing network details from one request to be incorrectly associated with a different request during session replay processing.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

@romtsn is there any issue with updating Breadcrumb#equals and Breadcrumb#hashmap to include data in the comparison?

I left it out in my commit cuz assumed we want Breadcrumbs to be equal if they have different data (e.g. it's the same breadcrumb if some more data gets added by a different caller at some point later)

sentry-android-core/src/main/java/io/sentry/android/core/AndroidOptionsInitializer.java

...ry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt

Entrypoint is NetworkDetailCaptureUtils (initializeForUrl) called from SentryOkHttpInterceptor - common logic to handle checking sdk options. - Accept data from http client via NetworkBodyExtractor, NetworkHeaderExtractor interfaces that can be reused in future (if needed) Placeholder impl for req/resp bodies. From https://docs.sentry.io/platforms/javascript/session-replay/configuration/ - networkDetailAllowUrls, networkDetailDenyUrls, - networkCaptureBodies - networkRequestHeaders, networkResponseHeaders These SDKOptions don't exist yet => impl acts as if they do, but have not been enabled.

to revert

…entries Removes entry when creating RRWebSpanEvent Uses syncrhonized LinkedHashMap with impl to cap size of map (avoid memory bloat)

Replaces previous placeholder logic. Now NetworkBodyParser uses io.sentry.JsonObjectReader to extract body into JSONObject, JSONArray, with fallback to plain-text String (or nothing)

Linter / formatting / tests / comments

sentry-io · 2025-10-27T19:36:15Z

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt

+    private val FAKE_OPTIONS = object {
+      val networkDetailAllowUrls: Array<String> = arrayOf(".*")
+      val networkDetailDenyUrls: Array<String>? = null
+      val networkCaptureBodies: Boolean = true
+      val networkRequestHeaders: Array<String> = arrayOf("User-Agent", "Accept", "sentry-trace", "Content-Type")
+      val networkResponseHeaders: Array<String> = arrayOf("User-Agent", "access-control-allow-origin", "x-ratelimit-resource")
+    }


Bug: The FAKE_OPTIONS object is hardcoded for network detail capture, overriding user configuration.
_{Severity: CRITICAL | Confidence: 1.00}

🔍 Detailed Analysis

The FAKE_OPTIONS object, intended for testing, is hardcoded and used for network detail capture. This causes the system to always use the test configuration, overriding any user-defined networkDetailAllowUrls, networkDetailDenyUrls, networkCaptureBodies, networkRequestHeaders, and networkResponseHeaders settings. Specifically, networkDetailAllowUrls is set to ".*" capturing all URLs, networkCaptureBodies is true always capturing bodies, and specific headers are hardcoded.

💡 Suggested Fix

Remove the FAKE_OPTIONS object and its usage. Implement the actual SentryOptions integration for network detail capture, or disable the feature until proper configuration is available.

🤖 Prompt for AI Agent

Fix this bug. In sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt at lines 67-73: The `FAKE_OPTIONS` object, intended for testing, is hardcoded and used for network detail capture. This causes the system to always use the test configuration, overriding any user-defined `networkDetailAllowUrls`, `networkDetailDenyUrls`, `networkCaptureBodies`, `networkRequestHeaders`, and `networkResponseHeaders` settings. Specifically, `networkDetailAllowUrls` is set to `".*"` capturing all URLs, `networkCaptureBodies` is `true` always capturing bodies, and specific headers are hardcoded.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

addressed in 4bc5b77

One-shot bodies Form bodies plain text bodies binary bodies

sentry/src/main/java/io/sentry/util/network/NetworkBodyParser.java

based on cursor[bot] feedback - https://github.com/getsentry/sentry-java/pull/4796/files#r2466871208

Removes unuseful test

@nonnull

https://github.com/getsentry/sentry-java/pull/4796/files#r2462011291 Entirely removed any null checks - reading through the code everything is annotated @nonnull, and in the case where a NoOpReplayController could be initialised (believe this is unexpected as ReplayIntegration is always enabled) the NoOpBreadcrumbConverter implements BeforeBreadcrumbCallback and simply no-ops => nothing to crash

Initialize the values in FAKE_OPTIONS so that implementation acts as if dev never turned it on. Leaves in the FAKE_OPTIONS variable to be easy to update reference to real `options` later on.

This reverts commit 5397e9d.

This reverts commit ca28040.

This reverts commit b8555e2.

43jay added 5 commits October 7, 2025 14:33

Update dsn for testing

b8555e2

Enable replay verbose logging

ca28040

Point dsn to sentry-android project

5397e9d

https://sentry-sdks.sentry.io/settings/projects/sentry-android/keys/

Add HTTP Request Trigger to sentry-samples-android app

71ed70e

[replay] Make DefaultReplayBreadcrumbConverter the default BeforeBrea…

f2ce22e

…dcrumbCallback to extract NetworkRequestData from Hint -> NetworkRequestData is landing on DefaultReplayBreadcrumbConverter via Hint.get(replay:networkDetails)

43jay requested review from adinauer, lcian, markushi, romtsn and stefanosiano as code owners October 9, 2025 21:27

43jay marked this pull request as draft October 9, 2025 21:28

This comment was marked as outdated.

Sign in to view

seer-by-sentry bot reviewed Oct 9, 2025

View reviewed changes

romtsn reviewed Oct 13, 2025

View reviewed changes

43jay added 4 commits October 13, 2025 10:52

Move BeforeBreadcrumbCallback initialization to after user config

2d08e7b

added some unit tests: ./gradlew :sentry-android-replay:testDebugUnitTest --tests="*DefaultReplayBreadcrumbConverterTest*"

43jay changed the title ~~RFF(replay): Adding OkHttp Request/Response bodies for sentry-java~~ replay(feature): Adding OkHttp Request/Response bodies for sentry-java Oct 24, 2025

43jay commented Oct 24, 2025

View reviewed changes

sentry/src/main/java/io/sentry/rrweb/RRWebOptionsEvent.java Outdated Show resolved Hide resolved

43jay marked this pull request as ready for review October 24, 2025 15:50

seer-by-sentry bot reviewed Oct 24, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

43jay commented Oct 24, 2025

View reviewed changes

sentry-android-core/src/main/java/io/sentry/android/core/AndroidOptionsInitializer.java Outdated Show resolved Hide resolved

43jay commented Oct 24, 2025

View reviewed changes

...ry-android-replay/src/main/java/io/sentry/android/replay/DefaultReplayBreadcrumbConverter.kt Outdated Show resolved Hide resolved

43jay force-pushed the 43jay/MOBILE-935 branch from 9a4852b to 82404ff Compare October 24, 2025 18:28

43jay added 5 commits October 24, 2025 15:38

Add FAKE_OPTIONS for testing

6964a53

to revert

DefaultReplayBreadcrumbConverter properly manages NetworkRequestData …

25c42c7

…entries Removes entry when creating RRWebSpanEvent Uses syncrhonized LinkedHashMap with impl to cap size of map (avoid memory bloat)

Extract bodies of okhttp requests/responses

308072b

Replaces previous placeholder logic. Now NetworkBodyParser uses io.sentry.JsonObjectReader to extract body into JSONObject, JSONArray, with fallback to plain-text String (or nothing)

Check-in sentry-android-replay.api

5836ef1

Cleanup

d9f8254

Linter / formatting / tests / comments

43jay force-pushed the 43jay/MOBILE-935 branch from 82404ff to d9f8254 Compare October 24, 2025 21:15

43jay marked this pull request as draft October 24, 2025 21:19

This comment was marked as resolved.

Sign in to view

This comment was marked as outdated.

Sign in to view

Linter

6b6f3fe

43jay marked this pull request as ready for review October 27, 2025 19:33

sentry-io bot reviewed Oct 27, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

43jay added 5 commits October 27, 2025 15:48

Linter and clean-up unused code

cadc529

Add additional http request types to sentry-samples app for testing

465b6e5

One-shot bodies Form bodies plain text bodies binary bodies

Cleaning up logging

6ab8e03

Formatting

d3f1a24

Add body too large http request types to sentry-samples app

9eba521

cursor bot reviewed Oct 27, 2025

View reviewed changes

sentry/src/main/java/io/sentry/util/network/NetworkBodyParser.java Outdated Show resolved Hide resolved

43jay added 7 commits October 27, 2025 16:58

Properly handle content bodies that are too large

8deffe9

based on cursor[bot] feedback - https://github.com/getsentry/sentry-java/pull/4796/files#r2466871208

Cleanup DefaultReplayBreadcrumbConverterTest

669c8a3

Removes unuseful test

Disable Network Detail extraction

4bc5b77

Initialize the values in FAKE_OPTIONS so that implementation acts as if dev never turned it on. Leaves in the FAKE_OPTIONS variable to be easy to update reference to real `options` later on.

Revert "Point dsn to sentry-android project"

177ae0c

This reverts commit 5397e9d.

Revert "Enable replay verbose logging"

a204a40

This reverts commit ca28040.

Revert "Update dsn for testing"

6629e94

This reverts commit b8555e2.

43jay requested a review from romtsn October 27, 2025 21:26

romtsn changed the title ~~replay(feature): Adding OkHttp Request/Response bodies for sentry-java~~ feat(replay): Adding OkHttp Request/Response bodies Oct 29, 2025

Uh oh!

Uh oh!

feat(replay): Adding OkHttp Request/Response bodies #4796

Are you sure you want to change the base?

feat(replay): Adding OkHttp Request/Response bodies #4796

Uh oh!

Conversation

43jay commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📜 Description

TODOs

💡 Motivation and Context

💚 How did you test it?

Uh oh!

linear bot commented Oct 9, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

seer-by-sentry bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

43jay Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

romtsn Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

43jay Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

seer-by-sentry bot Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

This comment was marked as outdated.

Uh oh!

sentry-io bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

43jay commented Oct 9, 2025 •

edited

Loading

43jay Oct 24, 2025 •

edited

Loading

romtsn Oct 13, 2025 •

edited

Loading

43jay Oct 24, 2025 •

edited

Loading