iFrame errors are not captured by the SDK

[rodolfoBee]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

8.30.0 (CDN import set to 8.x)

Framework Version

No response

Link to Sentry event

No response

Reproduction Example/SDK Setup

SDK setup follows the custom configuration:

<script>
window.sentryOnLoad = function () {
Sentry.init({
   replaysSessionSampleRate: 1.0,
   integrations: [
      Sentry.replayIntegration({
         maskAllText: false,
         maskAllInputs: false,
         blockAllMedia: false,
         networkDetailAllowUrls: [window.location.origin],
       }),
   ],
   sendDefaultPii: true,
});
Sentry.setUser([redacted]);
Sentry.setTag([redacted]);
};

</script>
<script src="https://js.sentry-cdn.com/[redacted].min.js" crossorigin="anonymous"></script>

Steps to Reproduce

Exact steps to reproduce are unclear.

Expected Result

Error events are captured by the SDK

Actual Result

Error events are not captured by the SDK.

In the following logs, you can see the SDK is initialised:

Sentry Logger [log]: Integration installed: InboundFilters logger.js:75:37
Sentry Logger [log]: Integration installed: FunctionToString logger.js:75:37
Sentry Logger [log]: Integration installed: BrowserApiErrors logger.js:75:37
Sentry Logger [log]: Integration installed: Breadcrumbs logger.js:75:37
Sentry Logger [log]: Global Handler attached: onerror logger.js:75:37
Sentry Logger [log]: Global Handler attached: onunhandledrejection logger.js:75:37
Sentry Logger [log]: Integration installed: GlobalHandlers logger.js:75:37
Sentry Logger [log]: Integration installed: LinkedErrors logger.js:75:37
Sentry Logger [log]: Integration installed: Dedupe logger.js:75:37
Sentry Logger [log]: Integration installed: HttpContext logger.js:75:37
Sentry Logger [log]: Integration installed: Replay logger.js:75:37
Sentry Logger [log]: Integration installed: BrowserTracing logger.js:75:37

Two uncaught errors are triggered inside an iFrame and are not sent by the SDK, the networks logs show no POST to sentry.io with error events.

Uncaught TypeError: $editable.html() is undefined
    startinPlaceLineEdit [redacted domain]/platform/global/xml_content_editor/Co_ContentEditor.js?v=2.8:1685
    Edit [redacted domain]/platform/global/xml_content_editor/Co_ContentEditor.js?v=2.8:2693
    OnClick [redacted domain]/platform/global/xml_content_editor/Co_ContentEditor.js?v=2.8:1810

The errors reported by the SDK log point to replay not being sent, not related to the error events:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://o[ORG_ID].ingest.us.sentry.io/api/4507544112136192/envelope/?sentry_key=[KEY_ID]&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.30.0. (Reason: CORS request did not succeed). Status code: (null).
Sentry Logger [log]: Recording outcome: "network_error:replay" 2 logger.js:75:37

The log above is also curious as other events are sent. The allowed domains option on the project settings is set to *.

[Lms24]

Hi, this is expected behaviour. The global window object inside an iframe is not the same as the window object in the host page where (I assume) the Sentry SDK is running. This means two things:

1. the Sentry SDK is not accessible within the iframe. EDIT: Theoretically, it is accessible via window.parent but you'd still need some mechanism to catch errors automatically (see 2)
2. errors and events from the iframe cannot be caught by the Sentry SDK on the host page because its instrumentation can't access events from within the iframe

If you control the iframe, the solution is to add the Sentry SDK to the iframe. Theoretically, you could send specific errors via the postMessage API to the host page and forward it to the SDK but that's for sure the more complicated approach.

[Lms24]

I'll close this for the moment. Please feel free to tag me if the customer issue isn't yet resolved.