feat(node): Add incoming request headers as OTel span attributes

dev-packages/e2e-tests/test-applications/nestjs-11/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-8/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-basic/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-distributed-tracing/tests/propagation.test.ts

@@ -32,6 +32,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
 
   const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+  const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+  // Outgoing span (`http.client`) does not include headers as attributes
+  expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
   expect(traceId).toEqual(expect.any(String));
 
   // data is passed through from the inbound request, to verify we have the correct headers set
@@ -75,6 +79,13 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-outgoing-http/:id',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -106,6 +117,10 @@ test('Propagates trace for outgoing http requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-inbound-headers/:id',
+      'http.request.header.baggage': expect.any(String),
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sentry_trace': expect.stringMatching(/[a-f0-9]{32}-[a-f0-9]{16}-1/),
     },
     op: 'http.server',
     parent_span_id: outgoingHttpSpanId,
@@ -146,6 +161,10 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
 
   const outgoingHttpSpanId = outgoingHttpSpan?.span_id;
 
+  const outgoingHttpSpanData = outgoingHttpSpan?.data || {};
+  // Outgoing span (`http.client`) does not include headers as attributes
+  expect(Object.keys(outgoingHttpSpanData).some(key => key.startsWith('http.request.header.'))).toBe(false);
+
   expect(traceId).toEqual(expect.any(String));
 
   // data is passed through from the inbound request, to verify we have the correct headers set
@@ -189,6 +208,13 @@ test('Propagates trace for outgoing fetch requests', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-outgoing-fetch/:id',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-fastify/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -103,6 +110,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
             'nestjs.controller': 'AppController',
             'nestjs.callback': 'testTransaction',
             url: '/test-transaction',
+            'http.request.header.accept': '*/*',
+            'http.request.header.accept_encoding': 'gzip, deflate',
+            'http.request.header.accept_language': '*',
+            'http.request.header.connection': 'keep-alive',
+            'http.request.header.host': expect.any(String),
+            'http.request.header.sec_fetch_mode': 'cors',
+            'http.request.header.user_agent': 'node',
           },
           description: 'GET /test-transaction',
           parent_span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules-decorator/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/example-module/transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nestjs-with-submodules/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction from module', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/example-module/transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/nextjs-15/tests/pageload-tracing.test.ts

@@ -22,3 +22,33 @@ test('App router transactions should be attached to the pageload request span',
   expect(pageloadTraceId).toBeTruthy();
   expect(serverTransaction.contexts?.trace?.trace_id).toBe(pageloadTraceId);
 });
+
+test('extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+  const serverTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+    return transactionEvent?.transaction === 'GET /pageload-tracing';
+  });
+
+  await fetch(`${baseURL}/pageload-tracing`, {
+    headers: {
+      'User-Agent': 'Custom-NextJS-Agent/15.0',
+      'Content-Type': 'text/html',
+      'X-NextJS-Test': 'nextjs-header-value',
+      Accept: 'text/html, application/xhtml+xml',
+      'X-Framework': 'Next.js',
+      'X-Request-ID': 'nextjs-789',
+    },
+  });
+
+  const serverTransaction = await serverTransactionPromise;
+
+  expect(serverTransaction.contexts?.trace?.data).toEqual(
+    expect.objectContaining({
+      'http.request.header.user_agent': 'Custom-NextJS-Agent/15.0',
+      'http.request.header.content_type': 'text/html',
+      'http.request.header.x_nextjs_test': 'nextjs-header-value',
+      'http.request.header.accept': 'text/html, application/xhtml+xml',
+      'http.request.header.x_framework': 'Next.js',
+      'http.request.header.x_request_id': 'nextjs-789',
+    }),
+  );
+});

dev-packages/e2e-tests/test-applications/node-connect/tests/transactions.test.ts

@@ -39,6 +39,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-core-express-otel-v1-custom-sampler/tests/sampling.test.ts

@@ -35,6 +35,13 @@ test('Sends a sampled API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     origin: 'manual',
     op: 'http.server',

dev-packages/e2e-tests/test-applications/node-core-express-otel-v1-sdk-node/tests/transactions.test.ts

@@ -49,6 +49,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-core-express-otel-v1/tests/transactions.test.ts

@@ -37,6 +37,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-core-express-otel-v2-custom-sampler/tests/sampling.test.ts

@@ -35,6 +35,13 @@ test('Sends a sampled API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     origin: 'manual',
     op: 'http.server',

dev-packages/e2e-tests/test-applications/node-core-express-otel-v2-sdk-node/tests/transactions.test.ts

@@ -49,6 +49,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-core-express-otel-v2/tests/transactions.test.ts

@@ -37,6 +37,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'net.peer.port': expect.any(Number),
       'http.status_code': 200,
       'http.status_text': 'OK',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express-v5/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),

dev-packages/e2e-tests/test-applications/node-express/tests/transactions.test.ts

@@ -38,6 +38,13 @@ test('Sends an API route transaction', async ({ baseURL }) => {
       'http.status_code': 200,
       'http.status_text': 'OK',
       'http.route': '/test-transaction',
+      'http.request.header.accept': '*/*',
+      'http.request.header.accept_encoding': 'gzip, deflate',
+      'http.request.header.accept_language': '*',
+      'http.request.header.connection': 'keep-alive',
+      'http.request.header.host': expect.any(String),
+      'http.request.header.sec_fetch_mode': 'cors',
+      'http.request.header.user_agent': 'node',
     },
     op: 'http.server',
     span_id: expect.stringMatching(/[a-f0-9]{16}/),
@@ -208,3 +215,34 @@ test('Sends an API route transaction for an errored route', async ({ baseURL })
     measurements: {},
   });
 });
+
+test('Extracts HTTP request headers as span attributes', async ({ baseURL }) => {
+  const transactionEventPromise = waitForTransaction('node-express', transactionEvent => {
+    return (
+      transactionEvent?.contexts?.trace?.op === 'http.server' &&
+      transactionEvent?.transaction === 'GET /test-transaction'
+    );
+  });
+
+  await fetch(`${baseURL}/test-transaction`, {
+    headers: {
+      'User-Agent': 'Custom-Agent/1.0 (Test)',
+      'Content-Type': 'application/json',
+      'X-Custom-Header': 'test-value',
+      Accept: 'application/json, text/plain',
+      'X-Request-ID': 'req-123',
+    },
+  });
+
+  const transactionEvent = await transactionEventPromise;
+
+  expect(transactionEvent.contexts?.trace?.data).toEqual(
+    expect.objectContaining({
+      'http.request.header.user_agent': 'Custom-Agent/1.0 (Test)',
+      'http.request.header.content_type': 'application/json',
+      'http.request.header.x_custom_header': 'test-value',
+      'http.request.header.accept': 'application/json, text/plain',
+      'http.request.header.x_request_id': 'req-123',
+    }),
+  );
+});