Use Raven-js coupled to sentry in phoneGap app

[Freyskeyd]

Hi,

I'm trying to use sentry with raven-js on a phoneGap project.
I've a little problem...it's about URL security.

In sentry for raven-js i need to define some URL to protect my server.
But, in phoneGap i've no URL on my app. So, sentry doesn't listen to my app.

How can i solve it?
Any modification is possible to allow all URL for a define project?

Thank's!

[dcramer]

In the sentry server you currently cant configure global origins per-project, but if you run the server you can configure the global value.

I believe the setting is::

SENTRY_ALLOW_ORIGIN = '*'

[Freyskeyd]

Okey, i'm gonna try tomorrow.
That's can be interesting to get issue report on android/ios app.

thank's

[dcramer]

Feel free to reopen this if there are any problems related to this.

(We could probably update the documentation to be more clear)

[Shyru]

I just tried doing the same thing with the current raven version (1.1) but had no luck.
I always got the an HTTP error 400 with "Missing required attribute in authentication header". The missing attribute is sentry_secret.
(BTW, we are using the hosted sentry and I configured the client security with *.
When loading the phonegap page in a browser a test event was correctly transmitted to sentry so generally this seems to work.
I think the problem is that when the image is loaded from the phonegap page, no referrer is given. This probably causes the sentry server to switch to a mode where the sentry_secret must be transmitted and no referrer check is done.
So I tried adding the secret key to the dsn, but then raven-js triggered an error because this is discouraged. (I think because sentry is mostly used in public websites).

I then modified my version of raven.js and added this line after 1495:
qs.push('sentry_secret=<my_secret>');

After retrying with this in place it worked successfully.
So how should we go on about implementing this correctly in sentry-js? We could add an additional method that allows to set the secret and document that this should only be used on non-public websites or inside phonegap or something similar. Or we could modify the config() method to only throw the mentioned exception if the code is executed in a browser and not inside phonegap. Then one could specify the secret in the dsn as normally.

I would be glad to implement whatever solution you deem fit. Just say what would be best, and I would fork and make a pull-request.
Thanks for looking into this!

[mattrobenolt]

@Shyru Does PhoneGap not sending a Referer or Origin header when making a request? At the moment, that's used for validation instead of the secret key.

[Shyru]

@mattrobenolt No, phonegap does not send a referer. I checked this with safari's webinspector. I think it is the normal browser behavior to not send referrers when files are loaded from the filesystem with file://-urls. After all, which referer should they send?

[julien-duponchelle]

I have the same issue, we want to use it with cordova but due to fact cordova use file:// url it's not allowed

[abuzzell]

Same problem here, although, oddly, IOS Cordova works, but Android does not.

[kof]

same here ... why isn't this resolved? Its actually pretty trivial to fix on the client by enabling optionally pass the host instead of going over location.href ...

[kof]

hmm wrong, its using origin from headers sent by the browser ....

[kof]

anyways this should be resolved somehow.

[kof]

huh it seems like * works already on sentry server, sorry for bugging you.

[TrevTheDev]

I have the same issue and SENTRY_ALLOW_ORIGIN = '*' is not working for me.