4 ms·
Something I’ve been wondering lately and have seen a few different — and rather surprising — takes: do you include source maps in production? I’ve seen a somew
by holman 9y ago
Something I’ve been wondering lately and have seen a few different — and rather surprising — takes: do you include source maps in production?
I’ve seen a somewhat surprising amount of people say that they absolutely wouldn’t these days, which seems fairly security-through-obscurity. Would love to hear some different opinions on this, though.
- akx 9y agoJust yesterday I used the source maps provided and a short script to "reverse-engineer" a third party's minified Webpack bundle into a tree of original source files, complete with comments...
- optimiz3 9y agoLocks make good neighbors, but they wont stop a thief. You're not obligated to make it easy for someone to reverse-engineer/steal/clone your client code.
- nallerooth 9y agoI wouldn't, or to be more precise - I wouldn't by default. I prefer to enable things like source maps via an environment variable or a special build - when I know that I need to debug something. By always including source maps, I just increase the asset size for the site's visitors, with "no benefit" (most end users won't have a clue about how to debug something). Regarding the security aspect - don't put anything you know to be sensitive/insecure on the Internet in the first place.
- holman 9y agoSource maps aren’t actually loaded by the browser unless specifically requested by opening web inspector, fwiw.
- draw_down 9y agoYes, the minified source should contain a URL for the source map. The map should not be included with the minified source, that would be counterproductive.
- thejosh 9y agoWe include them, but lock them away via nginx rules for sentry and dev IPs.
- TheAceOfHearts 9y agoYes, I include source maps in production. It only gets loaded when someone opens dev tools, and it provides better error stacks which makes debugging easier. You're correct that it's security through obscurity. IMO, it's an irrational fear.
- bruce_one 9y agoMy favourite is to create them and link them, but host them from an internal server so that no one external can access them (eg hosting it at http://internal.example.com/source.map http://internal.example.com/source.map) - so if anyone tries to load it, either the dns won't resolve or they won't be able to access the server.