Add a configuration setting to enable/disable XHR wrapping

[danielmohacsi]

I'm working on a third-party library, and our customers don't really like to see that their AJAX requests are being sent by our code. Unfortunately, after updating Raven-JS to the latest version, I can see on my Chrome Network tab that the initiator is raven.js for my customer's AJAX calls.

Therefore in order to keep using Sentry, and use the latest Raven-JS, we would need this XHR wrapping logic to be configurable.

[benvinegar]

Hey @danielmohacsi – you can specify your own transport using the transport config option. You could specify a function that reaches into your own code so that the originating script is yours and not raven.js.

[danielmohacsi]

Hi @benvinegar, thanks for getting back to me so quickly!

I think I was not 100% clear. My problem is that if my partner does an XMLHttpRequest to any particular server, Chrome's network panel will show my bundled code (which contains Raven-js) as the initiator.

Consider the following scenario:

1. http://www.example.com includes my code from http://danielmohacsi.com/best-code-ever.js.
2. My code includes Raven-js, and installs it.
3. example.com initiates a request to http://www.example.com/data.json
   As a result, Chrome will show that the request's initiator was my code, because Raven wraps XMLHttpRequests automatically.

This would not be a problem, but some of our customers do not really have the required technical background, and whenever they see something like that, they think that we are trying to steal some confidential information.

Do you think I can handle that scenario and make sure that http://www.example.com's requests are not showing my code as the initiator with the transport config option?
I don't have any problems with Sentry requests going to app.getsentry.com, as they are initiated by my bundled code anyway.

[benvinegar]

Ah, so the issue here is with the function wrapping. This happens once you call .install(). You can choose not to call install() and strictly rely on your own window.onerror implementation, e.g.

Raven.config('your dsn'); // don't call install()

var existingOnerror = window.onerror;
window.onerror = function (msg, url, line, col, err) {
  if (err && err.stack) {
    Raven.captureException(err);
  }
  existingOnerror && existingOnerror.apply(this, arguments);
};

But note that this will not get stack traces from some browsers like Safari and Microsoft Edge, and you will no longer get breadcrumbs. More on window onerror here: https://blog.getsentry.com/2016/01/04/client-javascript-reporting-window-onerror.html

[benvinegar]

Aside, we are looking at introducing configuration around this, but it won't be a one off for XMLHttpRequest. Raven.js instruments a bunch of functions – we'll let you opt into whichever.

[danielmohacsi]

Cool! Thanks for the insights! I really want to make sure that I'm not even touching the browser's XHR implementation. Although it would be nice to use all the cool features Raven provides, but XHR wrapping was the one thing which prevented me from updating to the latest version.