fix(core): Set http header span attributes as string arrays

`httpHeadersToSpanAttributes` now writes `http.request.header.<key>` /
`http.response.header.<key>` as a string array instead of a single string.
Headers sent multiple times previously got their values joined with `;`,
which lost the boundaries between values; each value is now its own array
entry.

This matches the Sentry/OTel semantic conventions and the shape the
outgoing-fetch (undici) instrumentation already emits for the same
attributes. `packages/browser`'s `httpContext` integration is updated too,
so `http.request.header.referer` isn't the one header attribute left as a
string. Cookie attributes (`http.request.header.cookie.<name>`) stay
single strings, as a cookie only ever has one value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Lms24

MIGRATION.md

@@ -798,6 +798,8 @@ On server-side HTTP spans, the `content-length` header is now always reported as
 
 The `http.request.header.<key>`/`http.response.header.<key>` attributes now write the header name lowercased as previously but no longer replaces dashes (`-`) with underscores (`_`). For example, the SDK now sets `http.request.header.user-agent` rather than `http.request.header.user_agent`. The same applies to the cookie names in `http.request.header.cookie.<name>` and `http.request.header.set-cookie.<name>`.
 
+Furthermore, the values of `http.request.header.<key>`/`http.response.header.<key>` are now string arrays instead of single strings, as mandated by the semantic conventions. Headers that were sent multiple times previously had their values joined into one string with a semicolon (`;`); they now yield one array entry per value. For example, the SDK now sets `http.request.header.accept-encoding` to `['gzip', 'deflate']` rather than `'gzip;deflate'`, and `http.request.header.user-agent` to `['Mozilla/5.0 ...']` rather than `'Mozilla/5.0 ...'`. The cookie attributes (`http.request.header.cookie.<name>`/`http.request.header.set-cookie.<name>`) continue to hold a single string, since a cookie only ever has one value.
+
 #### Network attributes
 
 Network-related span attributes now use the current Sentry semantic conventions, aligned across SDKs. If you query, transform, or alert on the legacy `net.*` fields, update those references:

dev-packages/browser-integration-tests/suites/integrations/httpContext-streamed/test.ts

@@ -22,8 +22,8 @@ sentryTest('httpContextIntegration captures url, user-agent, and referer', async
     value: expect.any(String),
   });
   expect(pageloadSpan!.attributes['http.request.header.referer']).toEqual({
-    type: 'string',
-    value: 'https://sentry.io/',
+    type: 'array',
+    value: ['https://sentry.io/'],
   });
 });
 

dev-packages/cloudflare-integration-tests/suites/public-api/startSpan-streamed/test.ts

@@ -226,36 +226,36 @@ it('sends a streamed span envelope with correct spans for a manually started spa
             value: 'node',
           },
           'http.request.header.accept': {
-            type: 'string',
-            value: '*/*',
+            type: 'array',
+            value: ['*/*'],
           },
           'http.request.header.accept-encoding': {
-            type: 'string',
-            value: 'br, gzip',
+            type: 'array',
+            value: ['br, gzip'],
           },
           'http.request.header.accept-language': {
-            type: 'string',
-            value: '*',
+            type: 'array',
+            value: ['*'],
           },
           'http.request.header.cf-connecting-ip': {
-            type: 'string',
-            value: '127.0.0.1',
+            type: 'array',
+            value: ['127.0.0.1'],
           },
           'user.ip_address': {
             type: 'string',
             value: '127.0.0.1',
           },
           'http.request.header.host': {
-            type: 'string',
-            value: expect.stringMatching(/^localhost:.+$/),
+            type: 'array',
+            value: [expect.stringMatching(/^localhost:.+$/)],
           },
           'http.request.header.sec-fetch-mode': {
-            type: 'string',
-            value: 'cors',
+            type: 'array',
+            value: ['cors'],
           },
           'http.request.header.user-agent': {
-            type: 'string',
-            value: 'node',
+            type: 'array',
+            value: ['node'],
           },
           'http.request.method': {
             type: 'string',

dev-packages/e2e-tests/test-applications/astro-4/tests/tracing.dynamic.test.ts

@@ -61,11 +61,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
       'sentry.sdk.name': { value: 'sentry.javascript.astro', type: 'string' },
       'url.full': { value: expect.stringContaining('/test-ssr'), type: 'string' },
       // demonstrates that the request data integration can extract headers
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 });
@@ -152,11 +152,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/user-page/myUsername123'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
 
     // HTTP client span - with span streaming only the domain is kept in the name, the URL lives in
@@ -174,11 +174,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.op': { value: 'http.server', type: 'string' },
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate', type: 'string' },
-      'http.request.header.accept-language': { value: '*', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'cors', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate'], type: 'array' },
+      'http.request.header.accept-language': { value: ['*'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['cors'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 
@@ -215,11 +215,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/catchAll/hell0/whatever-do'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 });
@@ -253,11 +253,11 @@ test.describe('parametrized vs static paths', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/user-page/settings'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 });

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.dynamic.test.ts

@@ -61,11 +61,11 @@ test.describe('tracing in dynamically rendered (ssr) routes', () => {
       'sentry.sdk.name': { value: 'sentry.javascript.astro', type: 'string' },
       'url.full': { value: expect.stringContaining('/test-ssr'), type: 'string' },
       // demonstrates that the request data integration can extract headers
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 });
@@ -152,11 +152,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/user-page/myUsername123'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
 
     // HTTP client span - with span streaming only the domain is kept in the name, the URL lives in
@@ -174,11 +174,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.op': { value: 'http.server', type: 'string' },
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate', type: 'string' },
-      'http.request.header.accept-language': { value: '*', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'cors', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate'], type: 'array' },
+      'http.request.header.accept-language': { value: ['*'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['cors'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 
@@ -215,11 +215,11 @@ test.describe('nested SSR routes (client, server, server request)', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/catchAll/hell0/whatever-do'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 });
@@ -253,11 +253,11 @@ test.describe('parametrized vs static paths', () => {
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
       'url.full': { value: expect.stringContaining('/user-page/settings'), type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'navigate', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['navigate'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
   });
 

dev-packages/e2e-tests/test-applications/astro-5/tests/tracing.serverIslands.test.ts

@@ -55,11 +55,11 @@ test.describe('tracing in static routes with server islands', () => {
       'sentry.op': { value: 'http.server', type: 'string' },
       'sentry.origin': { value: 'auto.http.astro', type: 'string' },
       'sentry.segment.name.source': { value: 'route', type: 'string' },
-      'http.request.header.accept': { value: expect.any(String), type: 'string' },
-      'http.request.header.accept-encoding': { value: 'gzip, deflate, br, zstd', type: 'string' },
-      'http.request.header.accept-language': { value: 'en-US', type: 'string' },
-      'http.request.header.sec-fetch-mode': { value: 'cors', type: 'string' },
-      'http.request.header.user-agent': { value: expect.any(String), type: 'string' },
+      'http.request.header.accept': { value: [expect.any(String)], type: 'array' },
+      'http.request.header.accept-encoding': { value: ['gzip, deflate, br, zstd'], type: 'array' },
+      'http.request.header.accept-language': { value: ['en-US'], type: 'array' },
+      'http.request.header.sec-fetch-mode': { value: ['cors'], type: 'array' },
+      'http.request.header.user-agent': { value: [expect.any(String)], type: 'array' },
     });
 
     // unfortunately, the server island trace id is not the same as the client pageload trace id