Why does the symbolicator requests js sourcemaps?

[renepupil]

We upload source maps after this guide for webpack, although we have to manually create some source maps with uglify-js because we can NOT easily add them all as webpack "entry points":

Encore
    .configureTerserPlugin((options) => {
        options.minify = async (input, sourceMap) => {  // `async` for speed.
            const filename = Object.keys(input)[0];
            let code = input[filename];
            let map = sourceMap;

            // REASONING: 
            // Because our "static" JavaScript modules are not added as webpack "entry points", they are not resolved as `SourceMapSource` internally, meaning webpacks SourceMapDevToolPlugin will not "attach" their source maps (although they are generated).
            // I don't know why SourceMapDevToolPlugin is not attaching these, for details of the investigation see https://github.com/webpack/webpack/discussions/19167 .    

            if (filename.includes('/') && !map) {
                let minified = require('uglify-js').minify(input, {
                    sourceMap: {
                        filename: filename, // Used for "file" attribute in source map.
                        includeSources: true, // Used for "sourcesContent" attribute in source map.
                    }
                });

                code = minified.code;
                map = minified.map;
            }

            return {code, map, warnings: [], errors: [], extractedComments: []};
        }
    })

We then upload sourcemaps with sentry-cli afterwards:

sentry-cli --url "${sentry_url}" --auth-token "${SENTRY_AUTH_TOKEN}" sourcemaps upload --org "${sentry_org_slug}" --project "${SENTRY_PROJECT}" --release "${COMMIT_HASH}" --url-prefix "~/assets/dist/modules" "${PROJECTPATH}/${PUBLIC_DIRECTORY}/assets/dist/modules"

Generating sourcemaps may expose them to the public, potentially causing your source code to be leaked. You can prevent this by configuring your server to deny access to .js.map files, or by using Sentry Webpack Plugin's sourcemaps.filesToDeleteAfterUpload option to delete source maps after they've been uploaded to Sentry.

As suggested in the docs, we remove the source maps after uploading them, although I use find to do that.

But now we get NotFoundHttpException from our Symfony application, because the symbolicator/25.2.0 GET requests the source maps that are set in the minified file via //# sourceMappingURL=<our-file>.<hash>.js.map.

As sentry should resolve source maps in the sentry application, not in the users browser, I have no idea why the symbolicator creates these requests.

Why does Symbolicator requests source maps in our case?

[lforst]

It's not the SDK or Sentry requesting the source map. It's your browser. Whenever you have a //# sourceMappingURL comment in any of your js files, the browser will try to fetch the source map for things like debugging and the sources dev tools view.

You can tell uglify not to emit a sourceMappingURL and the errors should go away.

[renepupil]

As you commented #12463 (comment), it is likely that setting you said (as I can see the User-Agent header is symbolicator...), right?