fix(nextjs): Make request data available to tracesSampler for edge middleware root spans

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+  return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+  return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+  // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+  // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+  if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+    await new Promise(resolve => setTimeout(resolve, 300));
+  }
+
+  return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+  matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
   environment: 'qa', // dynamic sampling bias to keep transactions
   dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
   tunnel: `http://localhost:3031/`, // proxy server
-  tracesSampleRate: 1.0,
+  tracesSampler: samplingContext => {
+    if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+      // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+      // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+      // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+      const { normalizedRequest } = samplingContext;
+      return Boolean(
+        normalizedRequest?.method &&
+        normalizedRequest?.url &&
+        normalizedRequest.url === samplingContext.attributes['http.target'],
+      );
+    }
+
+    return 1.0;
+  },
   dataCollection: { userInfo: true },
   transportOptions: {
     // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+  const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+    return transactionEvent?.transaction === 'middleware GET';
+  });
+
+  const response = await request.get('/api/endpoint-behind-middleware');
+  expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+  const middlewareTransaction = await middlewareTransactionPromise;
+
+  expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+  expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+  expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+  expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+  const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+    return (
+      transactionEvent?.transaction === 'middleware GET' &&
+      transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+    );
+  });
+
+  const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+    return (
+      transactionEvent?.transaction === 'middleware GET' &&
+      transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+    );
+  });
+
+  await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+  const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+  expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+  expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+  expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
   environment: 'qa', // dynamic sampling bias to keep transactions
   dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
   tunnel: `http://localhost:3031/`, // proxy server
-  tracesSampleRate: 1.0,
+  tracesSampler: samplingContext => {
+    if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+      // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+      // Test times out and fails when transaction is dropped
+      const { normalizedRequest } = samplingContext;
+      return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+    }
+
+    return 1.0;
+  },
   dataCollection: { userInfo: true },
   // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+    return transactionEvent?.transaction === 'middleware GET';
+  });
+
+  await request.get('/api/endpoint-behind-middleware');
+
+  const middlewareTransaction = await middlewareTransactionPromise;
+
+  expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+  expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+  expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
   const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
   expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
   expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+  expect(middlewareTransaction.request?.method).toBe('GET');
+  expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
   // Assert that isolation scope works properly
   expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
   expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+  getCapturedScopesOnSpan,
+  getCurrentScope,
+  getIsolationScope,
+  getRootSpan,
+  setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+  const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+  if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+    return;
+  }
+
+  if (span !== getRootSpan(span)) {
+    return;
+  }
+
+  const scopes = getCapturedScopesOnSpan(span);
+
+  const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+  const scope = scopes.scope || getCurrentScope();
+
+  const currentScopesPointer = getScopesFromContext(context.active());
+  if (currentScopesPointer) {
+    currentScopesPointer.isolationScope = isolationScope;
+  }
+
+  setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+  HTTP_METHOD,
+  HTTP_REQUEST_METHOD,
+  HTTP_TARGET,
+  HTTP_URL,
+  URL_FULL,
+  URL_PATH,
+  URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+  // eslint-disable-next-line typescript/no-deprecated
+  const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+  // eslint-disable-next-line typescript/no-deprecated
+  const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+  if (typeof method !== 'string' && typeof url !== 'string') {
+    return undefined;
+  }
+
+  const normalizedRequest: RequestEventData = {};
+
+  if (typeof method === 'string') {
+    normalizedRequest.method = method;
+  }
+
+  if (typeof url === 'string') {
+    normalizedRequest.url = url;
+
+    const queryFromAttribute = attributes[URL_QUERY];
+    if (typeof queryFromAttribute === 'string') {
+      normalizedRequest.query_string = queryFromAttribute;
+    } else {
+      const queryIndex = url.indexOf('?');
+      if (queryIndex !== -1) {
+        normalizedRequest.query_string = url.slice(queryIndex + 1);
+      }
+    }
+  }
+
+  return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
   applySdkMetadata,
-  getCapturedScopesOnSpan,
-  getCurrentScope,
   getGlobalScope,
   getIsolationScope,
   getRootSpan,
@@ -14,17 +11,17 @@ import {
   SEMANTIC_ATTRIBUTE_SENTRY_OP,
   SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
   SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
-  setCapturedScopesOnSpan,
   spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,20 @@ export function init(options: VercelEdgeOptions = {}): void {
 
   const client = vercelEdgeInit(opts);
 
+  // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+  // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+  client?.on('beforeSampling', ({ spanAttributes }) => {
+    const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+    if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+      return;
+    }
+
+    const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+    if (normalizedRequest) {
+      getIsolationScope().setSDKProcessingMetadata({ normalizedRequest });
+    }
+  });
+
   client?.on('spanStart', span => {
     const spanAttributes = spanToJSON(span).data;
     const rootSpan = getRootSpan(span);
@@ -120,19 +131,7 @@ export function init(options: VercelEdgeOptions = {}): void {
     }
 
     // We want to fork the isolation scope for incoming requests
-    if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
-      const scopes = getCapturedScopesOnSpan(span);
-
-      const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
-      const scope = scopes.scope || getCurrentScope();
-
-      const currentScopesPointer = getScopesFromContext(context.active());
-      if (currentScopesPointer) {
-        currentScopesPointer.isolationScope = isolationScope;
-      }
-
-      setCapturedScopesOnSpan(span, scope, isolationScope);
-    }
+    maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
     if (isRootSpan) {
       // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
-  getCapturedScopesOnSpan,
-  getCurrentScope,
-  getIsolationScope,
-  getRootSpan,
-  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
-  setCapturedScopesOnSpan,
-  spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
     addHeadersAsAttributes(headers, rootSpan);
   }
 
-  // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
-  // treatment since Next.js 16.3.0-canary.79
-  if (
-    (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
-      spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
-    isRootSpan
-  ) {
-    const scopes = getCapturedScopesOnSpan(span);
-
-    const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
-    const scope = scopes.scope || getCurrentScope();
-
-    const currentScopesPointer = getScopesFromContext(context.active());
-    if (currentScopesPointer) {
-      currentScopesPointer.isolationScope = isolationScope;
-    }
-
-    setCapturedScopesOnSpan(span, scope, isolationScope);
-  }
+  maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
   maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);