[antonis]

Exploratory draft, stacked on #6395, to discuss this review comment. Not meant to block #6395.

📜 Description

Adds SentryWebViewTracing.addTracePropagation(webView). When no hosts are passed, the allowed hosts come from tracePropagationTargets.

Only entries that name a plain host are used, because tracePropagationTargets are substring or regex matches on a full URL, and the WebView needs origin rules:

Target	Pages connected
api.example.com	That host and its subdomains
https://api.example.com/	That exact host
https://*.example.com	That host and its subdomains
.* (the default), a regex, an entry with a path, a host with no dot such as com	None: nothing is installed and the call returns false

Passing hosts explicitly works as before and takes priority.

💡 Motivation and Context

Reusing the existing option avoids a second host list, and could give automatic instrumentation through the Gradle plugin (#6407) an app-wide list.

Open questions:

• Is tracePropagationTargets acceptable as this trust boundary? The list is usually written with backends in mind, but here every script on a matching page can read the trace. This needs Security's review.
• Should a dedicated WebView hosts option take priority over it, so an app can keep HTTP propagation to a host without exposing the trace to its pages?
• A public suffix such as co.uk still passes the filter; catching it needs a public-suffix list.
• The React Native SDK requires explicit allowedHosts, so this would differ from it.

💚 How did you test it?

Unit tests for the target filter, the origin rules, and the new overload, including the default .*. :sentry-android-core:check, spotlessCheck, and checkKotlinAbi pass. Not run on a device yet.

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

If we go ahead: Security review, docs (getsentry/sentry-docs#20550), and a test on a device.

🤖 Generated with Claude Code

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against baf1646

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.63.0 (1)	release

⚙️ sentry-android Build Distribution Settings