feat(cloudflare): Capture request body via httpServerIntegration (#20614)

closes #17079
closes
[JS-751](https://linear.app/getsentry/issue/JS-751/capture-request-body-in-cloudflare-workers)

This PR is basically adding and exporting
`captureBodyFromWinterCGRequest` from `@sentry/core` and re-implementing
`httpServerIntegration` for Cloudflare. There was no way to reuse the
existing `httpServerIntegration`, as it is using
`patchRequestToCaptureBody`, which wouldn't work in Cloudflare, as there
is too late to be patched, so `captureBodyFromWinterCGRequest` was born.

The original `httpServerIntegration` is also taking care of other SDK
processing metadata via `httpRequestToRequestData`, which happens
already for every request in Cloudflare via the `addHandler` in the
[`scope-utils.ts`](https://github.com/getsentry/sentry-javascript/blob/99564760ce7914898d85ab83762b1531aec3d53a/packages/cloudflare/src/scope-utils.ts#L27).
I still tried to reuse as much code as possible (that's the reason for
the new exposed functionality in `@sentry/core`).

Two options from the original integration are missing `sessions` and
`sessionFlushingDelayMS`. I don't think this can be implemented 1:1,
that is why I left it out, as the sessions seem to be aggregated, which
wouldn't work in Cloudflare, as we generate a new client for each
request. And I think it is better if we don't enable that by default, as
otherwise every request would send a session by default.

In theory this would also be usable for other runtimes like Bun or Deno
if I'm not mistaken

Author: JPeer264

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-disabled/index.ts

@@ -0,0 +1,18 @@
+import * as Sentry from '@sentry/cloudflare';
+
+interface Env {
+  SENTRY_DSN: string;
+}
+
+export default Sentry.withSentry(
+  (env: Env) => ({
+    dsn: env.SENTRY_DSN,
+    integrations: [Sentry.httpServerIntegration({ maxRequestBodySize: 'none' })],
+  }),
+  {
+    async fetch(_request, _env, _ctx) {
+      Sentry.captureMessage('POST with disabled body capture');
+      return new Response('ok');
+    },
+  },
+);

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-disabled/test.ts

@@ -0,0 +1,26 @@
+import { expect, it } from 'vitest';
+import { createRunner } from '../../../runner';
+
+it('Does not capture request body when maxRequestBodySize is none', async ({ signal }) => {
+  const runner = createRunner(__dirname)
+    .expect(envelope => {
+      const event = envelope[1]?.[0]?.[1] as Record<string, unknown>;
+      expect(event.message).toBe('POST with disabled body capture');
+      expect(event.request).toEqual(
+        expect.objectContaining({
+          method: 'POST',
+          url: expect.any(String),
+        }),
+      );
+      // Body should NOT be captured
+      expect((event.request as Record<string, unknown>).data).toBeUndefined();
+    })
+    .start(signal);
+
+  await runner.makeRequest('post', '/', {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ secret: 'should-not-be-captured' }),
+  });
+
+  await runner.completed();
+});

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-disabled/wrangler.jsonc

@@ -0,0 +1,6 @@
+{
+  "name": "worker-name",
+  "compatibility_date": "2025-06-17",
+  "main": "index.ts",
+  "compatibility_flags": ["nodejs_compat"],
+}

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-filtered/index.ts

@@ -0,0 +1,18 @@
+import * as Sentry from '@sentry/cloudflare';
+
+interface Env {
+  SENTRY_DSN: string;
+}
+
+export default Sentry.withSentry(
+  (env: Env) => ({
+    dsn: env.SENTRY_DSN,
+    integrations: integrations => integrations.filter(i => i.name !== 'HttpServer'),
+  }),
+  {
+    async fetch(_request, _env, _ctx) {
+      Sentry.captureMessage('POST with filtered integration');
+      return new Response('ok');
+    },
+  },
+);

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-filtered/test.ts

@@ -0,0 +1,26 @@
+import { expect, it } from 'vitest';
+import { createRunner } from '../../../runner';
+
+it('Does not capture request body when httpServerIntegration is filtered out', async ({ signal }) => {
+  const runner = createRunner(__dirname)
+    .expect(envelope => {
+      const event = envelope[1]?.[0]?.[1] as Record<string, unknown>;
+      expect(event.message).toBe('POST with filtered integration');
+      expect(event.request).toEqual(
+        expect.objectContaining({
+          method: 'POST',
+          url: expect.any(String),
+        }),
+      );
+      // Body should NOT be captured when integration is filtered out
+      expect((event.request as Record<string, unknown>).data).toBeUndefined();
+    })
+    .start(signal);
+
+  await runner.makeRequest('post', '/', {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ secret: 'should-not-be-captured' }),
+  });
+
+  await runner.completed();
+});

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-filtered/wrangler.jsonc

@@ -0,0 +1,6 @@
+{
+  "name": "worker-name",
+  "compatibility_date": "2025-06-17",
+  "main": "index.ts",
+  "compatibility_flags": ["nodejs_compat"],
+}

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-ignore/index.ts

@@ -0,0 +1,38 @@
+import * as Sentry from '@sentry/cloudflare';
+
+interface Env {
+  SENTRY_DSN: string;
+}
+
+export default Sentry.withSentry(
+  (env: Env) => ({
+    dsn: env.SENTRY_DSN,
+    integrations: [
+      Sentry.httpServerIntegration({
+        ignoreRequestBody: url => url.includes('/health') || url.includes('/upload'),
+      }),
+    ],
+  }),
+  {
+    async fetch(request, _env, _ctx) {
+      const url = new URL(request.url);
+
+      if (url.pathname === '/health') {
+        Sentry.captureMessage('Health check');
+        return new Response('ok');
+      }
+
+      if (url.pathname === '/upload') {
+        Sentry.captureMessage('Upload request');
+        return new Response('ok');
+      }
+
+      if (url.pathname === '/api') {
+        Sentry.captureMessage('API request');
+        return new Response('ok');
+      }
+
+      return new Response('Not found', { status: 404 });
+    },
+  },
+);

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-ignore/test.ts

@@ -0,0 +1,56 @@
+import { expect, it } from 'vitest';
+import { createRunner } from '../../../runner';
+
+it('Does not capture body for ignored URLs (health check)', async ({ signal }) => {
+  const runner = createRunner(__dirname)
+    .expect(envelope => {
+      const event = envelope[1]?.[0]?.[1] as Record<string, unknown>;
+      expect(event.message).toBe('Health check');
+      // Body should NOT be captured because URL contains /health
+      expect((event.request as Record<string, unknown>).data).toBeUndefined();
+    })
+    .start(signal);
+
+  await runner.makeRequest('post', '/health', {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ status: 'checking' }),
+  });
+
+  await runner.completed();
+});
+
+it('Does not capture body for ignored URLs (upload)', async ({ signal }) => {
+  const runner = createRunner(__dirname)
+    .expect(envelope => {
+      const event = envelope[1]?.[0]?.[1] as Record<string, unknown>;
+      expect(event.message).toBe('Upload request');
+      // Body should NOT be captured because URL contains /upload
+      expect((event.request as Record<string, unknown>).data).toBeUndefined();
+    })
+    .start(signal);
+
+  await runner.makeRequest('post', '/upload', {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ file: 'large-data' }),
+  });
+
+  await runner.completed();
+});
+
+it('Captures body for non-ignored URLs', async ({ signal }) => {
+  const runner = createRunner(__dirname)
+    .expect(envelope => {
+      const event = envelope[1]?.[0]?.[1] as Record<string, unknown>;
+      expect(event.message).toBe('API request');
+      // Body SHOULD be captured because URL does not match ignore pattern
+      expect((event.request as Record<string, unknown>).data).toBe('{"action":"submit"}');
+    })
+    .start(signal);
+
+  await runner.makeRequest('post', '/api', {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ action: 'submit' }),
+  });
+
+  await runner.completed();
+});

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-ignore/wrangler.jsonc

@@ -0,0 +1,6 @@
+{
+  "name": "worker-name",
+  "compatibility_date": "2025-06-17",
+  "main": "index.ts",
+  "compatibility_flags": ["nodejs_compat"],
+}

dev-packages/cloudflare-integration-tests/suites/integrations/http-server-small/index.ts

@@ -0,0 +1,29 @@
+import * as Sentry from '@sentry/cloudflare';
+
+interface Env {
+  SENTRY_DSN: string;
+}
+
+export default Sentry.withSentry(
+  (env: Env) => ({
+    dsn: env.SENTRY_DSN,
+    integrations: [Sentry.httpServerIntegration({ maxRequestBodySize: 'small' })],
+  }),
+  {
+    async fetch(request, _env, _ctx) {
+      const url = new URL(request.url);
+
+      if (url.pathname === '/small-body') {
+        Sentry.captureMessage('Small body request');
+        return new Response('ok');
+      }
+
+      if (url.pathname === '/large-body') {
+        Sentry.captureMessage('Large body request');
+        return new Response('ok');
+      }
+
+      return new Response('Not found', { status: 404 });
+    },
+  },
+);