Skip to content

docs(javascript): clarify HTTP headers require sendDefaultPii #19070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MHJahanbakhsh wants to merge 1 commit into from
Closed

docs(javascript): clarify HTTP headers require sendDefaultPii #19070

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/platforms/javascript/common/configuration/options.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ Set to `false` to opt out, for example, when using a custom `tunnel` or when run
(v11). Use [`dataCollection`](#dataCollection) instead.
</Alert>

Set this option to `true` to send default PII data to Sentry. Among other things, enabling this will enable automatic IP address collection on events.
Set this option to `true` to send default PII data to Sentry. Among other things, enabling this will enable automatic IP address collection on events, and it is required to collect HTTP response headers (and most request headers) when you are not using [`dataCollection`](#dataCollection). See <PlatformLink to="/data-management/data-collected/#http-headers">Data Collected: HTTP Headers</PlatformLink> for details.

@s1gr1d s1gr1d Sep 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Request headers don't need sendDefaultPii, and the response-header part only applies to the browser httpClient integration when dataCollection is unset. I'd keep just the link to the Data Collected page here.

Suggested change
Set this option to `true` to send default PII data to Sentry. Among other things, enabling this will enable automatic IP address collection on events, and it is required to collect HTTP response headers (and most request headers) when you are not using [`dataCollection`](#dataCollection). See <PlatformLink to="/data-management/data-collected/#http-headers">Data Collected: HTTP Headers</PlatformLink> for details.
See <PlatformLink to="/data-management/data-collected/#http-headers">Data Collected: HTTP Headers</PlatformLink> for details.


For backwards compatibility, `sendDefaultPii: true` behaves like enabling all [`dataCollection`](#dataCollection) categories.
If both options are set, `dataCollection` takes precedence.
Expand Down
4 changes: 2 additions & 2 deletions docs/platforms/javascript/common/data-management/data-collected/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ Regardless of these options, you can always scrub any data before it's sent to S

## HTTP Headers

By default, the Sentry SDK sends HTTP request and response headers.
By default, the Sentry SDK does **not** send HTTP response headers, and most request headers are omitted as well (for example, browser SDKs may only include limited request headers such as `User-Agent`). When using `dataCollection`, however, request and response headers are collected with sensitive values scrubbed. Opt out by setting `dataCollection: { httpHeaders: false }`.

Use the `dataCollection.httpHeaders` option to control this. For example, set `dataCollection: { httpHeaders: false }` to disable it, or use `{ allow: [...] }` or `{ deny: [...] }` to restrict which header values are sent. Values whose keys match Sentry's built-in sensitive denylist (such as `auth`, `token`, or `password`) are automatically scrubbed, while the keys are kept.
To collect HTTP headers when not using `dataCollection`, set the deprecated `sendDefaultPii: true` in `Sentry.init()`. Response headers in particular require this opt-in (or an explicit `dataCollection.httpHeaders` setting). You can also restrict which header values are sent using `{ allow: [...] }` or `{ deny: [...] }` on `dataCollection.httpHeaders`. Values whose keys match Sentry's built-in sensitive denylist (such as `auth`, `token`, or `password`) are automatically scrubbed, while the keys are kept.
Comment on lines +25 to +27

@s1gr1d s1gr1d Sep 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"most request headers are omitted" isn't right for current versions: on the server, request headers are sent by default and only sensitive values are [Filtered] (httpServerSpansIntegration.ts#L194). The part about response headers is correct for the browser httpClient integration though.

Suggested change
By default, the Sentry SDK does **not** send HTTP response headers, and most request headers are omitted as well (for example, browser SDKs may only include limited request headers such as `User-Agent`). When using `dataCollection`, however, request and response headers are collected with sensitive values scrubbed. Opt out by setting `dataCollection: { httpHeaders: false }`.
Use the `dataCollection.httpHeaders` option to control this. For example, set `dataCollection: { httpHeaders: false }` to disable it, or use `{ allow: [...] }` or `{ deny: [...] }` to restrict which header values are sent. Values whose keys match Sentry's built-in sensitive denylist (such as `auth`, `token`, or `password`) are automatically scrubbed, while the keys are kept.
To collect HTTP headers when not using `dataCollection`, set the deprecated `sendDefaultPii: true` in `Sentry.init()`. Response headers in particular require this opt-in (or an explicit `dataCollection.httpHeaders` setting). You can also restrict which header values are sent using `{ allow: [...] }` or `{ deny: [...] }` on `dataCollection.httpHeaders`. Values whose keys match Sentry's built-in sensitive denylist (such as `auth`, `token`, or `password`) are automatically scrubbed, while the keys are kept.
When `dataCollection` is configured, the SDK collects HTTP request and response headers by default, with sensitive values (such as `auth`, `token`, or `password`) replaced by `[Filtered]` while the keys are kept. Opt out with `dataCollection: { httpHeaders: { request: false, response: false } }`, or restrict values with `{ allow: [...] }` / `{ deny: [...] }` on `request` and `response`.
When `dataCollection` is not configured, the SDK sends request headers with the same filtering, plus additional filtering of IP-related headers. Response headers from browser requests (`httpClient` integration) additionally require the deprecated `sendDefaultPii: true`.


## Cookies

Expand Down