Issue
I see sentry-trace and baggage headers on my HTTP requests, and I want to know where they come from and how to control which requests carry them.
Applies To
All SaaS Customers and Self-Hosted Users
Distributed Tracing
Symptoms
Requests fail because a CORS policy does not permit the
sentry-traceandbaggageheaders.
Resolution
A Sentry SDK adds the sentry-trace and baggage headers to outgoing HTTP requests to enable distributed tracing, which links spans across services and projects. Because these headers can be sent to any destination, a service that does not expect them (including one not using Sentry) can also receive them.
How the SDK decides which requests get these headers depends on the SDK type:
Server SDKs (such as Node.js and Python) add the headers to all outgoing requests by default.
Browser SDKs add the headers only to same-origin requests by default.
To control this, set the trace propagation allowlist so the headers are attached only to requests that should participate in Sentry tracing. The option is tracePropagationTargets in the JavaScript SDK and trace_propagation_targets in Python and several others. It accepts strings (matched as substrings of the URL) and regular expressions. For example, in Python:
sentry_sdk.init(
dsn="<your-dsn>",
trace_propagation_targets=[
"https://api.myproject.com",
r"https://.*\.myproject\.com",
],
)
See limiting trace propagation for your SDK.
If you receive these headers on a service you own and they break a CORS check, you have two options: allow the sentry-trace and baggage headers in your server's Access-Control-Allow-Headers response, or ask the team whose application sends the requests to restrict their trace propagation targets.