Mobile replay: no way to scrub network request and response bodies before they are sent #6873

Versions

@sentry/react-native 8.30.0, @sentry/core 10.76.0, sentry-cocoa 9.30.1 (bundled), React Native 0.86.3, Expo 57.

What's missing

mobileReplayIntegration can capture request and response bodies for the replay Network tab (networkDetailAllowUrls, networkCaptureBodies). There is no way for the app to scrub those bodies before they leave the device. The only control is networkDetailDenyUrls, which drops the whole body of an endpoint.

beforeBreadcrumb can't be used for this:

• the bodies are attached in the beforeAddBreadcrumb hook, which runs after beforeBreadcrumb
• for fetch responses (blob bodies) the enriched breadcrumb is sent to native later through syncBreadcrumbToNative, which skips every hook

So an app that wants bodies, minus a token or card field, has to choose between leaking the field and losing the whole body. Server-side data scrubbing is best effort and runs after the data has already left the device.

The web replay has the same capture options plus hooks to scrub recording data before it's sent, so this is a gap on mobile.

What we did

We added an option to mobileReplayIntegration that takes a function. Each captured request or response body is parsed as JSON when possible, passed through the function, and the result is what gets sent. We pass the same redaction function we use in beforeSend, so a body loses the same fields an error event would.

One edge case: a body over the 150 KB limit is truncated, and a truncated body can't be reliably parsed and scrubbed. When the option is set, we drop such a body entirely (keeping the size warning) instead of sending it unscrubbed.

It would be great to have an official option like this, or any hook that runs on the final network details for both the synchronous and the async (blob) path.