feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details by Cryptoteep · Pull Request #6473 · getsentry/sentry-react-native

Cryptoteep · 2026-07-19T09:18:39Z

📜 Description

In React Native, fetch is the whatwg-fetch polyfill built on XMLHttpRequest with responseType = 'blob', so every fetch response body landed in the binary branch of _getResponseBodyString and surfaced as [UNPARSEABLE_BODY_TYPE] in the Replay network tab — even when the payload was plain JSON or text. This PR inlines parseable Blob/ArrayBuffer response bodies like text bodies, following the approach sketched in the issue.

The async capture path

Binary bodies can only be read asynchronously (FileReader), but xhr breadcrumbs are forwarded to the native SDKs synchronously (the beforeAddBreadcrumb enrichment hook runs right before scope.addBreadcrumb, which syncs to native). So the enrichment itself can't wait for the read.

Instead, when body capture is enabled and an allow-listed xhr breadcrumb carries a text-like binary response, the wrapped beforeBreadcrumb (same wrapping pattern the integration already uses for beforeSend):

holds the breadcrumb (returns null),
reads the body — FileReader for blob with a 500 ms timeout, slicing to NETWORK_BODY_MAX_SIZE before the read so a huge payload is never fully read into memory; manual UTF-8 decode for arraybuffer (Hermes has no TextDecoder; uses it when available),
re-adds the identical breadcrumb via addBreadcrumb with the resolved body carried on the hint. Its timestamp was set on the first pass and is preserved; the user's beforeBreadcrumb runs only on the first pass; the resolved-body hint key makes the second pass skip the hold branch, and the existing beforeAddBreadcrumb enrichment uses the resolved body instead of reading xhr.response.

Guardrails, per the issue's considerations:

Still opt-in: only for URLs matching networkDetailAllowUrls (minus networkDetailDenyUrls) with networkCaptureBodies enabled; beforeBreadcrumb isn't wrapped at all otherwise.
Genuinely binary payloads (images, octet-stream, video…) are not read: only text-like content types (JSON, XML, text/*, form-urlencoded) qualify; everything else keeps the UNPARSEABLE_BODY_TYPE marker as before.
Read failure or timeout falls back to UNPARSEABLE_BODY_TYPE — never worse data than today.
Size cap reuses NETWORK_BODY_MAX_SIZE with the existing MAX_BODY_SIZE_EXCEEDED warning.

Trade-off to be aware of: a held breadcrumb reaches the scope (and native) a few ms later than its neighbors, so strict insertion order among breadcrumbs can shift; the breadcrumb's own timestamp stays correct. Request bodies for fetch (Request / RequestInit.body Blobs) are intentionally left for a follow-up, as noted in the issue.

💚 How did you test it?

20 new unit tests across networkUtils, xhrUtils and mobilereplay covering: content-type classification, the manual UTF-8 decoder (multi-byte, invalid sequences, no-TextDecoder path), FileReader success/error/timeout, blob slicing + truncation warning, the hold/re-add flow, single execution of the user's beforeBreadcrumb, user drops staying dropped, and no wrapping when capture is off.
Full test/replay suite green (115 tests); tsc -p tsconfig.build.json, oxlint and oxfmt clean.

📝 Checklist

I reviewed the submitted code.
I added tests to verify the changes.
No new PII beyond the existing opt-in (networkDetailAllowUrls + networkCaptureBodies, auth-like headers still stripped).
I updated the docs if needed.
All tests passing.
No breaking changes.

🤖 Generated with Claude Code

…sion Replay network details React Native's fetch polyfill is built on XMLHttpRequest with responseType 'blob', so every fetch response body previously surfaced as [UNPARSEABLE_BODY_TYPE] in the Replay network tab even when the payload was plain JSON or text. Binary bodies can only be read asynchronously, while xhr breadcrumbs are forwarded to the native SDKs synchronously. When an allow-listed xhr breadcrumb carries a text-like (JSON/XML/text/form) Blob or ArrayBuffer response and body capture is enabled, the breadcrumb is now held in beforeBreadcrumb, the body is read (FileReader for Blob with a 500ms timeout, capped at NETWORK_BODY_MAX_SIZE by slicing before the read; manual UTF-8 decode for ArrayBuffer since Hermes has no TextDecoder), and the same breadcrumb is re-added with the resolved body on the hint. Its original timestamp is preserved. Genuinely binary payloads (images, octet-stream) keep the UNPARSEABLE_BODY_TYPE marker without being read, and read failures or timeouts fall back to the same marker. Closes getsentry#6376 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-07-19T09:18:58Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details by Cryptoteep in #6473

_{🤖 This preview updates automatically when you update the PR.}

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…f-8 decoder dropping bytes after an interrupted sequence - resolveXhrResponseBody now snapshots request headers, raw response headers and the response body size synchronously, and the re-added breadcrumb is enriched only from that snapshot — the live xhr may have been reused or cleared during the async gap (Bugbot: stale XHR data). - the manual UTF-8 fallback decoder no longer discards bytes following a truncated/interrupted multi-byte sequence; the consumed prefix decodes to a single U+FFFD (maximal subpart), matching TextDecoder. - drop non-null assertions flagged by oxlint no-unnecessary-type-assertion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…lid code point A structurally complete sequence that decodes to a surrogate or a code point above U+10FFFF previously advanced by one byte, so its continuation bytes were re-decoded as stray bytes and produced extra U+FFFDs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e479547. Configure here.}

cursor · 2026-07-19T23:34:12Z

+          .then(undefined, (error: unknown) => {
+            debug.error(`[Sentry] ${MOBILE_REPLAY_INTEGRATION_NAME} Failed to re-add network breadcrumb`, error);
+          });
+        return null;


Held fetch breadcrumbs miss error events

High Severity

Returning null from beforeBreadcrumb while awaiting FileReader drops allow-listed fetch xhr breadcrumbs from the scope until the read finishes. RN fetch always uses responseType: 'blob', and FileReader completion runs after promise microtasks, so errors thrown in fetch response handlers (and hard crashes in that window) no longer include that network breadcrumb — a regression versus the previous synchronous UNPARSEABLE_BODY_TYPE path. Flagged under the PR review correctness guidance for instrumentation that must not lose telemetry on common error paths.

Additional Locations (2)

packages/core/src/js/replay/networkUtils.ts#L201-L232

packages/core/src/js/replay/xhrUtils.ts#L280-L289

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit e479547. Configure here.}

alwx

Nicely scoped and well tested. A few small things inline — none blocking.

alwx · 2026-07-24T07:16:35Z

 export const NETWORK_BODY_MAX_SIZE = 150_000;

+/** How long to wait for an async body read (FileReader) before giving up. */
+export const NETWORK_BODY_READ_TIMEOUT_MS = 500;


500ms feels tight for a large JSON on a cold Hermes VM.

alwx · 2026-07-24T07:16:35Z

+ * engine provides one and falls back to a manual decoder otherwise (Hermes
+ * has no TextDecoder). Invalid sequences decode to U+FFFD.
+ */
+export function decodeUtf8(bytes: Uint8Array): string {


That's a lot of UTF-8 decoding to own. Hermes has had TextDecoder since RN 0.71

alwx · 2026-07-28T13:23:43Z

Since there is no activity in this PR so I'm going to close it and carry the work over to #6533.
Thanks @Cryptoteep for submitting this!

…sion Replay network details React Native's fetch polyfill is built on XMLHttpRequest with responseType 'blob', so every fetch response body previously surfaced as [UNPARSEABLE_BODY_TYPE] in the Replay network tab even when the payload was plain JSON or text. Binary bodies can only be read asynchronously, while xhr breadcrumbs are forwarded to the native SDKs synchronously. When an allow-listed xhr breadcrumb carries a text-like (JSON/XML/text/form) Blob or ArrayBuffer response and body capture is enabled, the breadcrumb is held in beforeBreadcrumb, the body is read (FileReader for Blob with a 500ms timeout, capped at NETWORK_BODY_MAX_SIZE by slicing before the read; manual UTF-8 decode for ArrayBuffer since Hermes has no TextDecoder), and the same breadcrumb is re-added with the resolved body on the hint. Its original timestamp is preserved. Genuinely binary payloads (images, octet-stream) keep the UNPARSEABLE_BODY_TYPE marker without being read, and read failures or timeouts fall back to the same marker. Squashed from #6473. Closes #6376

…sion Replay network details (#6533) * feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details React Native's fetch polyfill is built on XMLHttpRequest with responseType 'blob', so every fetch response body previously surfaced as [UNPARSEABLE_BODY_TYPE] in the Replay network tab even when the payload was plain JSON or text. Binary bodies can only be read asynchronously, while xhr breadcrumbs are forwarded to the native SDKs synchronously. When an allow-listed xhr breadcrumb carries a text-like (JSON/XML/text/form) Blob or ArrayBuffer response and body capture is enabled, the breadcrumb is held in beforeBreadcrumb, the body is read (FileReader for Blob with a 500ms timeout, capped at NETWORK_BODY_MAX_SIZE by slicing before the read; manual UTF-8 decode for ArrayBuffer since Hermes has no TextDecoder), and the same breadcrumb is re-added with the resolved body on the hint. Its original timestamp is preserved. Genuinely binary payloads (images, octet-stream) keep the UNPARSEABLE_BODY_TYPE marker without being read, and read failures or timeouts fall back to the same marker. Squashed from #6473. Closes #6376 * fix(replay): keep held network breadcrumbs on the scope, defer only the native sync Holding the breadcrumb in beforeBreadcrumb (returning null) until the async body read finished removed it from the scope entirely, so an error captured in that window lost it from event.breadcrumbs. The common `if (!res.ok) throw` path hits this reliably: the app never reads the body, so nothing yields long enough for the FileReader to land before the throw. Breadcrumbs are also filtered by timestamp into replay segments on Android, so a re-added crumb could be dropped from the replay when it straddled a segment boundary. The breadcrumb is now returned as before and lands on the JS scope immediately. Only the sync to native — which is what feeds the Replay network tab, since the native converters build the rrweb span from the synced xhr breadcrumb — is deferred, via deferBreadcrumbNativeSync/syncBreadcrumbToNative in scopeSync, and performed once with the resolved body. buildResolvedNetworkBreadcrumb builds the native-bound copy so the breadcrumb already on the scope is never mutated. Also in this change: - Retry a truncated blob read with a shorter slice. Slicing at a byte offset can cut a multi-byte UTF-8 sequence, and iOS decodes via -[NSString initWithData:encoding:], which returns nil for the whole chunk rather than substituting U+FFFD — so bodies over the cap silently fell back to UNPARSEABLE_BODY_TYPE. readBlobAsText now rejects with a distinguishable BLOB_DECODE_FAILED and the read retries with up to 3 fewer bytes, which is guaranteed to reach a character boundary. Timeouts and read errors are not retried. - Match javascript/ecmascript content types as text-like. - Update the networkDetailAllowUrls docs, which still said fetch bodies were unsupported. - Correct the abort() comment: RN's FileReader never enters LOADING, so abort() dispatches no events and does not cancel the native read. - Note in decodeUtf8 that the manual decoder is the path actually taken — neither Hermes nor JSC ships TextDecoder, so the TextDecoder branch only runs in tests. Adds test/replay/networkBodyCapture.test.ts, which exercises the whole flow against the real @sentry/core pipeline and the real scope sync patch. It guards the object-identity assumption the deferral relies on: the breadcrumb returned from beforeBreadcrumb must be the exact object passed to scope.addBreadcrumb. * Update CHANGELOG.md Co-authored-by: Antonis Lilis <antonis.lilis@sentry.io> --------- Co-authored-by: Andreev Kirill Andreevich <andreev.gh2017@yandex.ru> Co-authored-by: Antonis Lilis <antonis.lilis@sentry.io>

Cryptoteep requested review from alwx, antonis and lucas-zimerman as code owners July 19, 2026 09:18

changelog

5aee932

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cursor Bot reviewed Jul 19, 2026

View reviewed changes

Comment thread packages/core/src/js/replay/mobilereplay.ts

Comment thread packages/core/src/js/replay/networkUtils.ts Outdated

cursor Bot reviewed Jul 19, 2026

View reviewed changes

Comment thread packages/core/src/js/replay/networkUtils.ts

cursor Bot reviewed Jul 19, 2026

View reviewed changes

alwx reviewed Jul 24, 2026

View reviewed changes

alwx requested changes Jul 24, 2026

View reviewed changes

alwx mentioned this pull request Jul 28, 2026

feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details #6533

Merged

11 tasks

alwx closed this Jul 28, 2026

sentry-release-bot Bot mentioned this pull request Jul 30, 2026

publish: getsentry/sentry-react-native@8.21.0 getsentry/publish#9079

Closed

3 tasks

github-actions Bot mentioned this pull request Jul 30, 2026

Session Replay: capture fetch/binary (Blob, ArrayBuffer) response bodies in network detail #6376

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details - #6473

feat(replay): capture fetch (Blob/ArrayBuffer) response bodies in Session Replay network details#6473
Cryptoteep wants to merge 4 commits into
getsentry:mainfrom
Cryptoteep:feat/replay-fetch-blob-response-bodies

Cryptoteep commented Jul 19, 2026 •

edited by antonis

Loading

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 19, 2026

Uh oh!

alwx left a comment

Uh oh!

alwx Jul 24, 2026 •

edited

Loading

Uh oh!

alwx Jul 24, 2026 •

edited

Loading

Uh oh!

alwx commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Cryptoteep commented Jul 19, 2026 • edited by antonis Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📜 Description

The async capture path

💚 How did you test it?

📝 Checklist

Uh oh!

github-actions Bot commented Jul 19, 2026

Semver Impact of This PR

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 19, 2026

Choose a reason for hiding this comment

Held fetch breadcrumbs miss error events

Uh oh!

alwx left a comment

Choose a reason for hiding this comment

Uh oh!

alwx Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alwx Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alwx commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Cryptoteep commented Jul 19, 2026 •

edited by antonis

Loading

alwx Jul 24, 2026 •

edited

Loading

alwx Jul 24, 2026 •

edited

Loading