Sentry: difference between DSN with secret and without

[codekitchen]

I haven't been able to find anything in the docs -- how does the sentry server treat auth differently when given a DSN with the secret, vs a DSN without (from raven-js and the like)? Both forms of DSN are used only to report errors, as I understand it, but presumably there's some difference?

[dcramer]

The secret has explicit trust, whereas the public key has some minor protections to prevent easy abuse. Either way, both of them allow you to send events without verification, though we don't allow use of the public key except in specific situations (as they require certain other details to be present).

Specifically the public DSN is _only_ used by the JavaScript, and I believe Flash SDKs, and is entirely specific to browsers.

[CharlesHarley]

Would be great if this was explicitly stated in the docs. e.g. here https://docs.sentry.io/clients/ruby/#configuration

If you're using Sentry for both JS and Rails logging it is a bit of a gotcha to just put the public DSN into an environment variable and assume it'll work for both.

[ishitatsuyuki]

I'm not sure I agree with this. Currently Sentry on mobile uses the private DSN, while a mobile app is not tamper / reverse-engineering free.

There's no Google-like restriction (app fingerprint on mobile, Referer on Web) either, so I'm not sure there's any meaning for splitting them into two.