fix(fastapi): do not consume request body

sentry_sdk/integrations/asgi.py

@@ -36,6 +36,7 @@
     _get_installed_modules,
 )
 from sentry_sdk.tracing import Transaction
+from sentry_sdk.integrations._wsgi_common import request_body_within_bounds
 
 from typing import TYPE_CHECKING
 
@@ -178,6 +179,21 @@ async def _run_asgi3(self, scope, receive, send):
         # type: (Any, Any, Any) -> Any
         return await self._run_app(scope, receive, send, asgi_version=3)
 
+    async def _eagerly_receive_body(self, receive):
+        body = b""
+        buffered_messages = []
+        while True:
+            msg = await receive()
+            buffered_messages.append(msg)
+
+            if "body" in msg:
+                body += msg["body"]
+
+            if not msg.get("more_body", False):
+                break
+
+        return body, buffered_messages
+
     async def _run_app(self, scope, receive, send, asgi_version):
         # type: (Any, Any, Any, int) -> Any
         is_recursive_asgi_middleware = _asgi_middleware_applied.get(False)
@@ -213,10 +229,11 @@ async def _run_app(self, scope, receive, send, asgi_version):
 
                     method = scope.get("method", "").upper()
                     transaction = None
+                    headers = _get_headers(scope)
                     if ty in ("http", "websocket"):
                         if ty == "websocket" or method in self.http_methods_to_capture:
                             transaction = continue_trace(
-                                _get_headers(scope),
+                                headers,
                                 op="{}.server".format(ty),
                                 name=transaction_name,
                                 source=transaction_source,
@@ -241,6 +258,31 @@ async def _run_app(self, scope, receive, send, asgi_version):
                         if transaction is not None
                         else nullcontext()
                     ):
+                        client = sentry_sdk.get_client()
+
+                        read_request_body = (
+                            "content-length" in headers
+                            and request_body_within_bounds(
+                                client, int(headers["content-length"])
+                            )
+                        )
+                        scope.setdefault("state", {})[
+                            "sentry_sdk.content-length"
+                        ] = None
+
+                        buffered_messages = []
+                        if read_request_body:
+                            body, buffered_messages = await self._eagerly_receive_body(
+                                receive
+                            )
+                            scope["state"]["sentry_sdk.raw_body"] = body
+
+                        # Replay wrapper: first return buffered messages, then delegate to original receive
+                        async def _sentry_replay_receive():
+                            if buffered_messages:
+                                return buffered_messages.pop(0)
+                            return await receive()
+
                         try:
 
                             async def _sentry_wrapped_send(event):
@@ -255,10 +297,18 @@ async def _sentry_wrapped_send(event):
 
                                 return await send(event)
 
-                            if asgi_version == 2:
+                            if asgi_version == 2 and read_request_body:
+                                return await self.app(scope)(
+                                    _sentry_replay_receive, _sentry_wrapped_send
+                                )
+                            elif asgi_version == 2:
                                 return await self.app(scope)(
                                     receive, _sentry_wrapped_send
                                 )
+                            elif read_request_body:
+                                return await self.app(
+                                    scope, _sentry_replay_receive, _sentry_wrapped_send
+                                )
                             else:
                                 return await self.app(
                                     scope, receive, _sentry_wrapped_send

sentry_sdk/integrations/fastapi.py

@@ -18,6 +18,7 @@
     from sentry_sdk.integrations.starlette import (
         StarletteIntegration,
         StarletteRequestExtractor,
+        _patch_request,
     )
 except DidNotEnable:
     raise DidNotEnable("Starlette is not installed")
@@ -103,20 +104,22 @@ async def _sentry_app(*args, **kwargs):
                 return await old_app(*args, **kwargs)
 
             request = args[0]
+            _patch_request(request)
 
             _set_transaction_name_and_source(
                 sentry_sdk.get_current_scope(), integration.transaction_style, request
             )
             sentry_scope = sentry_sdk.get_isolation_scope()
-            extractor = StarletteRequestExtractor(request)
-            info = await extractor.extract_request_info()
 
             def _make_request_event_processor(req, integration):
                 # type: (Any, Any) -> Callable[[Event, Dict[str, Any]], Event]
                 def event_processor(event, hint):
                     # type: (Event, Dict[str, Any]) -> Event
 
                     # Extract information from request
+                    extractor = StarletteRequestExtractor(request)
+                    info = extractor.extract_request_info(req.scope)
+
                     request_info = event.get("request", {})
                     if info:
                         if "cookies" in info and should_send_default_pii():