StarletteIntegration overwrites the user set during a request (AuthenticationMiddleware) #6756

import sentry_sdk
from sentry_sdk.integrations.starlette import StarletteIntegration
from starlette.applications import Starlette
from starlette.authentication import AuthCredentials, AuthenticationBackend, SimpleUser
from starlette.middleware import Middleware
from starlette.middleware.authentication import AuthenticationMiddleware
from starlette.responses import PlainTextResponse
from starlette.routing import Route
from starlette.testclient import TestClient

captured = []

class TokenBackend(AuthenticationBackend):
    async def authenticate(self, conn):
        # request principal only carries the token subject (username)
        return AuthCredentials(["authenticated"]), SimpleUser("token-subject-123")

async def endpoint(request):
    # app enriches the Sentry user during the request
    sentry_sdk.set_user({"id": "user_42", "email": "real@user.com", "username": "token-subject-123"})
    return PlainTextResponse("ok")

def capture(event, hint):
    captured.append(event.get("user"))
    return None  # drop, don't send

sentry_sdk.init(
    dsn="https://public@o0.ingest.sentry.io/0",
    send_default_pii=True,
    traces_sample_rate=1.0,
    integrations=[StarletteIntegration()],
    before_send_transaction=capture,
)

app = Starlette(
    routes=[Route("/", endpoint)],
    middleware=[Middleware(AuthenticationMiddleware, backend=TokenBackend())],
)
TestClient(app).get("/")
print(captured[-1])

{'username': 'token-subject-123', 'id': 'user_42', 'email': 'real@user.com'}

{'username': 'token-subject-123'}