docs(sourcemaps): Document token exclusion when Allowed Domains is * - #18999
Open
elramen wants to merge 1 commit into
Open
docs(sourcemaps): Document token exclusion when Allowed Domains is *#18999elramen wants to merge 1 commit into
elramen wants to merge 1 commit into
Conversation
elramen
requested review from
danielsheccoury-sentry and
rodolfoBee
and
a lite review from Copilot
August 10, 2026 12:21
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the JavaScript sourcemaps documentation to reflect that Sentry only includes the security token header when “Allowed Domains” is not configured as a wildcard (*), helping prevent confusing source map scraping failures.
Changes:
- Clarified when the
X-Sentry-Tokenheader is included for source map scraping requests. - Fixed/improved the phrasing around “Security Token” + “Allowed Domains” behavior.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| If you want to keep your source maps secret and choose not to upload your source maps directly to Sentry, you can enable the “Security Token” option in your project settings. | ||
|
|
||
| This will cause outbound requests from Sentry’s servers to URLs originating from your “Allowed Domains” to have the HTTP header `X-Sentry-Token` header append: | ||
| With “Security Token” enabled and “Allowed Domains” not set to `*`, outbound requests from Sentry’s servers to URLs matching “Allowed Domains” will include the HTTP header `X-Sentry-Token`: |
Member
Author
There was a problem hiding this comment.
I think it's better to lead with the limitation rather than putting it at the end in case someone doesn't read the full thing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DESCRIBE YOUR PR
After getsentry/sentry#120182, sentry no longer sends the user-provided security token to symbolicator - which uses it for sourcemap scraping - if
Allowed Domainsis set to*. Unfortunately, this has broken stack traces for customers without them understanding why. This change is one step towards preventing this.Ref: INGEST-1111
IS YOUR CHANGE URGENT?
PRE-MERGE CHECKLIST
Make sure you've checked the following before merging your changes: