Sentry-javascript: 403 while trying to use showReportDialog()

[kellycampbell]

Do you want to request a feature or report a bug?

bug

What is the current behavior?

The report dialog is not shown.

In the Network devtools panel, Sentry.io returns a 403 error for the request to

https://sentry.io/api/embed/error-page/?eventId=[eventid]&dsn=[dsn-url]

The call immediately before the failing one is the POST to https://sentry.io/api/108606/store/ and it succeeds.

What is the expected behavior?

It should show the report dialog.

Version: raven-js 3.24.2
Environment: Cordova app on Android (same as already closed #751)
Settings: Allowed Domains = '*' in the Project Settings

[kamilogorek]

Hey @kellycampbell. I'm not very familiar with Cordova, however, I'm pretty sure that the issue is caused by not sending a Referer header alongside your request (it's not required for events, thus they work just fine for you).

Please see this related issue for Electron, it should explain the cause - https://github.com/getsentry/raven-js/issues/1297#issuecomment-380186018

[kellycampbell]

Cordova just runs a local JS app within the system WebView on mobile platforms. I imagine that this same problem exists on any Sentry connected site run from a WebView with local JS code.

I will look into ways to set the Referer header on a webview, since I think it's unset by default when running local code.

[kamilogorek]

I know that https://github.com/wymsee/cordova-HTTP can do that for sure

[kamilogorek]

Closing due to inactivity. Feel free to reopen if still relevant.

[felixhagspiel]

@kamilogorek I have the same problem using the raven JS SDK.
Here is a screenshot of the request:

Should not setting the Referer Header be handled by the SDK?
This is how I try to open the feedback dialog:

  import * as Raven from 'raven-js';
  ...
  Raven.showReportDialog({
    eventId: Raven.lastEventId(),
    user
  });

[hkdobrev]

@kamilogorek We're experiencing the same issue using the latest version of the Sentry JavaScript SDK 4.3.0. It doesn't send the Referrer header. We were trying to solve through support until we realised what the issue is ourselves. How could we solve that without allowing all domains in our Sentry project settings?

[felixhagspiel]

Is there any update on this?