feat: Implement strict trace continuation by giortzisg · Pull Request #4981 · getsentry/sentry-dotnet

giortzisg · 2026-03-04T13:11:22Z

Summary

Implements strict trace continuation to validate org IDs in distributed traces, preventing trace continuation from unknown third-party services.

Parse org_id from DSN host (e.g., o1 in https://key@o1.ingest.us.sentry.io/123 yields org ID "1")
Add OrgId config option to manually override DSN-parsed value
Add StrictTraceContinuation bool config option (default false)
Propagate sentry-org_id in outgoing baggage via DynamicSamplingContext
Validate org IDs in Hub.ContinueTrace():
- Mismatched org IDs always start a new trace (regardless of setting)
- Missing incoming org_id + StrictTraceContinuation: true -> start new trace
- Missing incoming org_id + StrictTraceContinuation: false -> continue trace (default behavior)

Changes

Source files:

src/Sentry/Dsn.cs - Parse org ID from DSN host subdomain
src/Sentry/SentryOptions.cs - Add StrictTraceContinuation and OrgId options, GetEffectiveOrgId() helper
src/Sentry/DynamicSamplingContext.cs - Add org_id to outgoing baggage in all DSC factory methods
src/Sentry/Internal/Hub.cs - Add ShouldContinueTrace() validation logic in ContinueTrace()

Test files:

test/Sentry.Tests/Protocol/DsnTests.cs - Tests for DSN org ID parsing
test/Sentry.Tests/HubTests.cs - Comprehensive [Theory] tests for all org ID validation scenarios

Snapshot files:

Updated 4 API approval snapshot files with new OrgId and StrictTraceContinuation properties

References

Go implementation: feat: add StrictTraceContinuation option sentry-go#1210
JS implementation: feat(core): Implement strictTraceContinuation sentry-javascript#16313
Python implementation: Add org_id support sentry-python#5166

Closes #4963

Add org ID validation to distributed trace continuation to prevent traces from being continued across different Sentry organizations. - Parse org ID from DSN host (e.g., o1.ingest.us.sentry.io -> "1") - Add OrgId option to SentryOptions to override DSN-parsed value - Add StrictTraceContinuation bool option (default false) - Propagate sentry-org_id in outgoing baggage via DynamicSamplingContext - Validate org IDs in Hub.ContinueTrace: - Mismatched org IDs always start new trace (regardless of setting) - Missing incoming org_id + strict=true -> start new trace - Missing incoming org_id + strict=false -> continue trace (default) - Add comprehensive tests for all org ID validation scenarios - Update API approval snapshots Closes #4963 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-03-04T13:11:44Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

The _Metrics_ APIs are now stable: removed Experimental from SentrySdk, SentryOptions and IHub by Flash0ver in #5023

Features ✨

Report a new _Diagnostic_ (SENTRY1001) when a Metrics-API is invoked with an unsupported numeric type by Flash0ver in #4840

feat: Implement strict trace continuation by giortzisg in #4981

Fixes 🐛

fix: include Data set via ITransactionTracer in SentryTransaction by Flash0ver in #4148
fix: CaptureFeedback now applies event processors by jamescrosswell in #4942

Dependencies ⬆️

Deps

chore(deps): update Cocoa SDK to v9.7.0 by github-actions in #5015
chore(deps): update Java SDK to v8.35.0 by github-actions in #5017
chore(deps): replaced the heavy protobuf-javalite 3.25.8 dependency with a light-weight epitaph 0.1.0 alternative on Android (getsentry/sentry-java#5157) by github-actions in #5017
chore(deps): update CLI to v3.3.3 by github-actions in #5002
chore(deps): update Cocoa SDK to v9.6.0 by github-actions in #4958

Other

ref: Use .NET 6.0 ArgumentNullException throw helpers by copilot-swe-agent in #4985

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-03-04T13:11:52Z

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against b178f46

…ion to CreateFromHeaders - Add CHANGELOG.md entry for strict trace continuation feature (#4981) - Fix CS8632 build error by adding #nullable enable before test methods using string? parameters in HubTests.cs - Add org ID mismatch validation directly in SentryPropagationContext.CreateFromHeaders so it starts a new trace when SDK and baggage org IDs don't match - Pass effective org ID from Hub.ContinueTrace to CreateFromHeaders - Add CreateFromHeaders_WithOrgMismatch_StartsNewTrace and CreateFromHeaders_WithOrgMatch_ContinuesTrace tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jamescrosswell · 2026-03-18T00:34:30Z

@giortzisg I've added some context to AGENTS.md in #5035, which should give the agent enough context to be able to correct this PR (once that's been merged into main/this PR).

…tinuation-v2

codecov · 2026-03-19T03:48:21Z

Codecov Report

❌ Patch coverage is 94.82759% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.07%. Comparing base (a4a8ded) to head (2366084).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Sentry/SentryOptions.cs	71.42%	1 Missing and 1 partial ⚠️
src/Sentry/SentryPropagationContext.cs	85.71%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4981      +/-   ##
==========================================
+ Coverage   74.03%   74.07%   +0.04%     
==========================================
  Files         499      499              
  Lines       18044    18100      +56     
  Branches     3510     3527      +17     
==========================================
+ Hits        13358    13408      +50     
- Misses       3830     3832       +2     
- Partials      856      860       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jamescrosswell · 2026-03-19T21:42:19Z

@giortzisg / @Flash0ver this looks good to me. OK to merge?

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-19T21:47:36Z

src/Sentry/SentryPropagationContext.cs

+                logger?.LogInfo("Org ID mismatch (SDK: {0}, baggage: {1}). Starting new trace.", sdkOrgId, baggageOrgId);
+                return new SentryPropagationContext();
+            }
+        }


Duplicate org ID validation creates inconsistent defense layers

Medium Severity

The org ID mismatch check in CreateFromHeaders duplicates logic already in Hub.ShouldContinueTrace(). Since CreateFromHeaders is only called from Hub.ContinueTrace() (confirmed by grep), and the Hub already nulls both headers when validation fails, this check is unreachable dead code in practice. Worse, the CreateFromHeaders version is incomplete — it handles only the mismatch case but not StrictTraceContinuation scenarios (missing org IDs). This inconsistency creates maintenance risk if one check is updated without the other, and could mislead developers into thinking CreateFromHeaders provides complete org ID validation.

Additional Locations (1)

src/Sentry/Internal/Hub.cs#L377-L409

Flash0ver mentioned this pull request Mar 4, 2026

feat: Add strict trace continuation support #4972

Closed

3 tasks

Flash0ver self-assigned this Mar 17, 2026

jamescrosswell mentioned this pull request Mar 18, 2026

chore: Added context re bindable options for agents #5035

Merged

jamescrosswell added 2 commits March 19, 2026 15:26

Merge remote-tracking branch 'origin/main' into feat/strict-trace-con…

4e5e3a6

…tinuation-v2

Fix bindable options

2366084

jamescrosswell approved these changes Mar 19, 2026

View reviewed changes

jamescrosswell marked this pull request as ready for review March 19, 2026 21:41

jamescrosswell requested a review from Flash0ver as a code owner March 19, 2026 21:41

cursor bot reviewed Mar 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Implement strict trace continuation#4981

feat: Implement strict trace continuation#4981
giortzisg wants to merge 4 commits intomainfrom
feat/strict-trace-continuation-v2

giortzisg commented Mar 4, 2026

Uh oh!

github-actions bot commented Mar 4, 2026 •

edited

Loading

Breaking Changes 🛠

Features ✨

Fixes 🐛

Dependencies ⬆️

Deps

Other

Uh oh!

github-actions bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

jamescrosswell commented Mar 18, 2026

Uh oh!

codecov bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

jamescrosswell commented Mar 19, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

giortzisg commented Mar 4, 2026

Summary

Changes

References

Uh oh!

github-actions bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Breaking Changes 🛠

Features ✨

Fixes 🐛

Dependencies ⬆️

Deps

Other

Uh oh!

github-actions bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jamescrosswell commented Mar 18, 2026

Uh oh!

codecov bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jamescrosswell commented Mar 19, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 19, 2026

Choose a reason for hiding this comment

Duplicate org ID validation creates inconsistent defense layers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Mar 4, 2026 •

edited

Loading

github-actions bot commented Mar 4, 2026 •

edited

Loading

codecov bot commented Mar 19, 2026 •

edited

Loading