Sentry-javascript: 403 when origin is null

[springuper]

I'm developing a web app for Samsung Smart TV. It uses local file protocol, other than normal http. When sentry catches some error and sends to server, there is a 403 response, with the following body:

{
  "error": "Missing required attribute in authentication header: sentry_secret"
}

I checked the request header, found that origin header is null. When assigning a valid origin in postman, such like 'abc.com', it's ok.

My question is, how can I fix this issue? change origin settings in sentry, or generate a private DSN?

[LewisJEllis]

Take a look at the allowSecretKey config field, documented here: https://docs.sentry.io/clients/javascript/config. If you enable that option and then use a secret DSN, things should start working.

[springuper]

That's helpful, @LewisJEllis. Will try your solution.

[y-lohse]

Hi, I had the same issue and solved it with the same solution, so thanks for that!

However, at least for us the issue suddenly appeared with v3.21 and the switch to fetch — I guess inside a cordova app, fetch and XHR don't behave exactly the same, at least when it comes to Origin headers.
I was also unable to force the Origin header, whether through the headers option for raven or the fetchOptions.headers.

So in hindsight, I think this should be considered a breaking change and warrant a new major version.

[kamilogorek]

Hey, sorry for the inconvenience @y-lohse. We're working on the next major version right now and we'll make sure that it won't create issues like the one you described above.

[bbaia]

I got the same error with @sentry/browser when working with local file protocol.

@sentry/browser: 5.3.0
Sentry: 8.16.0

[bbaia]

To fix my issue, I had to force using XHRTransport:

Sentry.init({
  ...
  transport: Sentry.Transports.XHRTransport,
});