Sentry: [feature-request] support hidden sourcemaps

[salzhrani]

offline sourcemaps cause errors to appear in the console, it would be great if a map file was included in a release to be used with errors regardless of the presence of the sourceMappingURL footer comment. for example if app.js and app.js.map are part of the release, then app.js.map should be utlized automatically or with opting-in somehow.

[dcramer]

We support the full spec, and you can send the X-SourceMap header along with the files and we'll use that instead:

https://docs.sentry.io/api/releases/post-release-files/

[salzhrani]

Is it possible via sentry-cli?

[dcramer]

@mitsuhiko do we support sending headers via the CLI?

We do plan to build a new sourcemap dedicated endpoint which makes this all easier (and doesnt require you to understand HTTP)

[mitsuhiko]

@dcramer not yet but i can add that. Just need to figure out how to not attach this to all files then since right now we do a batch upload.

[salzhrani]

any issues filed regarding sending the headers via CLI?

[mitsuhiko]

Just made an issue for it here: https://github.com/getsentry/sentry-cli/issues/25

Feel free to give input over there.

[rizkysyazuli]

so, referring to this:

In many cases your application may sit behind firewalls or you simply can’t expose source code to the public. Sentry provides an abstraction called Releases which you can attach source artifacts to.

The release API is intended to allow you to store source files (and sourcemaps) within Sentry. This removes the requirement for them to be web-accessible, and also removes any inconsistency that could come from network flakiness (on either your end, or Sentry’s end).

which is exactly our case. we can't expose our code to public. which means we will be using Webpack's hidden-source-map option.

but looking at the discussion here. seems that our sourcemap will be unreadable if we treat it this way? even though we used the sentry-cli to upload our source files & sourcemaps? is that correct?

[mitsuhiko]

If you use the current sentry-cli tool (sortof recent version) then an x-sourcemap header is sent automatically and sentry will find it. You just need to make sure sentry-cli can detect the sourcemap -> minified js relationship. So if you have a foo.min.js and a foo.min.js.map for instance we will detect that relationship on upload. The tool spits out the links it detects.

[rizkysyazuli]

@mitsuhiko i'm looking at the output right now. seems a bit hit and miss. some has it, some don't. here's an example:

 -> https://someurl.com/mobile/id/vendorlist.min.js [minified script]
  5c0227461cdd32ced75fef7e718faedcf2595f07  (1243107 bytes)
  -> sourcemap: vendorlist.min.js.map
 -> https://someurl.com/mobile/id/eventregister.min.js.map [sourcemap]
  57ae30ba68960a98c504b45370223d20be9bc2f6  (9756152 bytes)
 -> https://someurl.com/mobile/id/about.min.js.map [sourcemap]
  6965664c17c894aee503e561eb493111382c1bb1  (7812490 bytes)
 -> https://someurl.com/desktop/id/20.20.min.js [minified script]
  8898f55f228e1d861247554c99e42d1cfed4907b  (9070 bytes)
  -> sourcemap: 20.20.min.js.map
 -> https://someurl.com/mobile/id/unsubscribeemail.min.js [minified script]
  7f55a309e9ac1a9c9f9f27e2febfdbd287834556  (939296 bytes)
  -> sourcemap: unsubscribeemail.min.js.map

[mitsuhiko]

Looks like they all have sourcemap references correctly set up. The ones that do not print out a sourcemap references are not minified scripts.

[rizkysyazuli]

@mitsuhiko i don't get it. yes, those that don't have reference are the .map files itself. so where's the .js files?

[mitsuhiko]

@rizkysyazuli The way this is supposed to work:

• minified js files are uploaded and point to the sourcemaps. This as you can see works correctly
• sourcemaps are uploaded

You do not need the .js files because the sourcemaps contain everything. In case they do not (because your tool does not support extended sourcemaps) you can pass --rewrite to the upload-sourcemaps command which will rewrite the sourcemaps to contain all information (like embedded sourcecode) before upload.

[rizkysyazuli]

@mitsuhiko got it. so js files are not really required. and using hidden-source-map will work.

but since you brought up about the output of sentry-cli, now i'm wondering why some of the .js files are uploaded, while others are not. even thought the doc said this:

All files that end with .js and .map below /path/to/assets are automatically uploaded to the release

 -> https://someurl.com/mobile/id/vendorlist.min.js [minified script] <<-- js & sourcemap
  5c0227461cdd32ced75fef7e718faedcf2595f07  (1243107 bytes)
  -> sourcemap: vendorlist.min.js.map
 -> https://someurl.com/mobile/id/eventregister.min.js.map [sourcemap] <<-- sourcemap only
  57ae30ba68960a98c504b45370223d20be9bc2f6  (9756152 bytes)
 -> https://someurl.com/mobile/id/about.min.js.map [sourcemap] <<-- sourcemap only
  6965664c17c894aee503e561eb493111382c1bb1  (7812490 bytes)
 -> https://someurl.com/desktop/id/20.20.min.js [minified script] <<-- js & sourcemap
  8898f55f228e1d861247554c99e42d1cfed4907b  (9070 bytes)
  -> sourcemap: 20.20.min.js.map
 -> https://someurl.com/mobile/id/unsubscribeemail.min.js [minified script] <<-- js & sourcemap
  7f55a309e9ac1a9c9f9f27e2febfdbd287834556  (939296 bytes)
  -> sourcemap: unsubscribeemail.min.js.map

[mitsuhiko]

That I can't tell you. Is there a eventregister.min.js? If you want help debugging this it would be great to get a full list of the files that were not uploaded but you expect to be uploaded.

[borisirota]

Hi @dcramer

We support the full spec, and you can send the X-SourceMap header along with the files and we'll use that instead:

https://docs.sentry.io/api/releases/post-release-files/

Is the X-SourceMap header really supported ? source maps stack trace mapping doesn't work for me this way and I can't find documentation for this feature (the link you provided isn't valid).

Everything works as expected if I'm uploading files to sentry without the X-SourceMap header and not removing the sourcemap comment from js files
->

...
...
//# sourceMappingURL=06bd570b1cd4661110c5.js.map

->
source maps showing the correct stack trace on errors

I'm uploading files to sentry through the webpack-sentry-plugin which allows setting the X-SourceMap header through this PR but all the combinations I tried aren't working:

1. Setting both X-SourceMap and SourceMap headers.
2. making the path to the map file relative and absolute (the files located at /assets/js/* and both SOURCE_FILE.js.map and /assets/js/SOURCE_FILE.js.map aren't working)

I looked into sentry-cli code and did exactly what they are doing, which is, setting the Sourcemap header but nothing works for me.

My setup:

• sourcemaps aren't publicly accessible (accessible only to sentry because I uploaded both sourcemaps and js files)
• js files doesn't contain the sourcemap comment inside
• I'm uploading both js and map files to sentry and setting the X-SourceMap and SourceMap headers for js files to point to the map files

Any ideas ? Am I missing something ? Documentation of this feature somewhere ?

Thanks

[dcramer]

@getsentry/native could someone take a look and confirm X-SourceMap isnt broken? I thought we had tests for this so I'm assuming it's fine, but not sure what would be up here.

[mitsuhiko]

The sourcemap header works. This is what sentry-cli sets when uploading sourcemaps together. I'm assuming the value of the header might be wrong.

@borisirota the webpack-sentry-plugin is known to cause issues. I never investigated what it does, but it does something wrong. There were some issues reported in the past with it. I recommend using sentry-cli's upload support for now as we are not maintaining the webpack plugin.

[borisirota]

@mitsuhiko thanks for the quick reply. I'm using webpack-sentry-plugin for the last few months and didn't stumble into issues. maybe there were some issues before.

I tried to make the sourcemap header work with sentry-cli few months ago without success.
I'll try again now in order to isolate the problem and let you know.

In addition, I can give you my organization, project and release (which I uploaded to with the sourcemap header) details in order to check if something is broken there.

[borisirota]

sentry-cli isn't auto detecting source maps in my case. No idea why.

I have a folder with both js and map files and the js files aren't containing the SourceMapURL comment:

16a5fa59c5716572ea59.js
16a5fa59c5716572ea59.js.map
1873eedd917b5017a884.js
1873eedd917b5017a884.js.map
29139a0ffc602b996acd.js
29139a0ffc602b996acd.js.map
32e79eba4e285ed10eb2.js
32e79eba4e285ed10eb2.js.map
39cde8ded8cfdc56d7cc.js
39cde8ded8cfdc56d7cc.js.map
50f5623d11087b7454fd.js
50f5623d11087b7454fd.js.map
5e64925c424f4edc0157.js
5e64925c424f4edc0157.js.map
5f650c0baaad1c20b221.js
5f650c0baaad1c20b221.js.map
800df433708c51ad736e.js
800df433708c51ad736e.js.map
970cb70f3729adc6258c.js
970cb70f3729adc6258c.js.map
b9e5917270d0098f9682.js
b9e5917270d0098f9682.js.map
dc842c4f0de4bae3082b.js
dc842c4f0de4bae3082b.js.map

executing the sentry-cli releases files 7d42617 upload-sourcemaps . --url-prefix "~/assets/js" command in this folder reports:

> Adding source map references
> Analyzing 24 sources
> Uploading source maps for release 7d42617

Source Map Upload Report
  Minified Scripts
    ~/assets/js/16a5fa59c5716572ea59.js (no sourcemap ref)
    ~/assets/js/1873eedd917b5017a884.js (no sourcemap ref)
    ~/assets/js/29139a0ffc602b996acd.js (no sourcemap ref)
    ~/assets/js/32e79eba4e285ed10eb2.js (no sourcemap ref)
    ~/assets/js/39cde8ded8cfdc56d7cc.js (no sourcemap ref)
    ~/assets/js/50f5623d11087b7454fd.js (no sourcemap ref)
    ~/assets/js/5e64925c424f4edc0157.js (no sourcemap ref)
    ~/assets/js/5f650c0baaad1c20b221.js (no sourcemap ref)
    ~/assets/js/800df433708c51ad736e.js (no sourcemap ref)
    ~/assets/js/970cb70f3729adc6258c.js (no sourcemap ref)
    ~/assets/js/b9e5917270d0098f9682.js (no sourcemap ref)
    ~/assets/js/dc842c4f0de4bae3082b.js (no sourcemap ref)
  Source Maps
    ~/assets/js/16a5fa59c5716572ea59.js.map
    ~/assets/js/1873eedd917b5017a884.js.map
    ~/assets/js/29139a0ffc602b996acd.js.map
    ~/assets/js/32e79eba4e285ed10eb2.js.map
    ~/assets/js/39cde8ded8cfdc56d7cc.js.map
    ~/assets/js/50f5623d11087b7454fd.js.map
    ~/assets/js/5e64925c424f4edc0157.js.map
    ~/assets/js/5f650c0baaad1c20b221.js.map
    ~/assets/js/800df433708c51ad736e.js.map

No source map references and it shows only 9 map files but 12 were uploaded.

Any ideas ?

Currently, even though it seems like you do support the SourceMap header, I'm not able to make it work neither through the cli nor the rest api.

Thanks

[mitsuhiko]

Which version of sentry-cli are you using here?

[mitsuhiko]

Nevermind. It looks like we do not map from foo.js to foo.js.map only from foo.min.js to foo.js.map or foo.min.js.map. Will fix this.

[borisirota]

@mitsuhiko I checked the source for this issue with v1.20.0 with .min as part of the filename and it does recognize the map files but only if the SourceMapURL comment is present. Which is exactly what I'm trying to avoid with the X-SourceMap header alternative. Is this the expected behavior ?

If the SourceMapURL comment is present there is no need for the cli to find js and map couples :)

[mitsuhiko]

No. It should figure this out itself. I will reopen the issue so that it does not fall through the cracks.

[borisirota]

@mitsuhiko Any chance that this is the same issue on your backend when uploading artifacts with the X-SourceMap header alternative ?
This is how I was uploading js files (without the SourceMapURL comment) while setting the X-SourceMap header (rest api) but without success of mapping exceptions to the source code when one is thrown on client side.

Thanks !

[mitsuhiko]

@borisirota what do you mean with "this is the same issue on your backend when uploading artifacts with the X-SourceMap header alternative"?

The issue here is a client bug in sentry-cli (which I did not manage to reproduce yet).

[borisirota]

I mean that maybe the backend isn't able to map js file to the relevant map file when the js file isn't containing the SourceMapURL (but was uploaded with the X-SourceMap header) => which is the same behavior I'm facing with the client bug in sentry-cli.

[mitsuhiko]

I mean that maybe the backend isn't able to map js file to the relevant map file when the js file isn't containing the SourceMapURL

That is expected behavior.

which is the same behavior I'm facing with the client bug in sentry-cli.

That is a bug we have not been able to replicate. If you upload sourcemaps with sentry-cli the tool during upload is intended to automatically generate a SourceMap header that maps from minified file to sourcemap if the upload happened in the same go.

[borisirota]

That is expected behavior.

The js file was uploaded to sentry with the X-SourceMap header instead so there is no need for the SourceMapURL comment, no ?

If you upload sourcemaps with sentry-cli the tool during upload is intended to automatically generate a SourceMap header that maps from minified file to sourcemap if the upload happened in the same go.

Im my case, the SourceMap header is being generated only if the js file contains the SourceMapURL comment pointing to its map file.

[satyanash]

This X-SourceMap header seems like a decent compromise for now, but I can't find any documentation about it. Can anybody here point to or clarify what its value should be for a sample upload?

[mitsuhiko]

Going to close this now as this issue is long solved. Hidden sourcemaps are supported out of the box through uploads triggered through sentry-cli.

[niksy]

Is this really working as intended? I’m only getting full support when my files are ending with .min.js.

Doesn’t work:

core_9f267b6ba4.js
core_9f267b6ba4.js.map

Works:

core_9f267b6ba4.min.js
core_9f267b6ba4.min.js.map

[dcramer]

You can validate your sourcemaps here: https://sourcemaps.io/