Is there a way to safely use Sentry's source map feature in a production environment?

[convcha]

I use Remix along with Sentry's source map support.

https://docs.sentry.io/platforms/javascript/guides/remix/

This is extremely useful!
However, I am not sure if it is safe to use this source map feature in Production.

I initially thought it would be this way.

a) Source code to upload to Sentry.
Generated with remix build -sourcemap.

b) Source code to actually run on the server
Generated with remix build.

However, the file names in a) and b) do not match in this way.

e.g.
With source map
public/build/routes/index-V3LYSNCQ.js
public/build/routes/index-V3LYSNCQ.js.map

Without source map
public/build/routes/index-H3XOOMVB.js

Therefore, you need to generate b) with remix build -sourcemap.
This will cause the browser to see the source code before compression, so we manually remove the .map file.
However, for some reason, the source code of entry.client.tsx and root.tsx is visible.

Also, when I run remix build -sourcemap, I get a strong warning as shown below.

Even if you are careful not to hardcode the secret as described in this warning, it is still a bit scary....
What is the best way to do this?

#355
I thought this issue was related but I am not sure.

[sergiodxa]

After the build, upload the source maps to Sentry, then remove it from the public/build folder and deploy.

[convcha]

I got it.
Thanks!

[thomasverleye]

@convcha did you end up removing the source maps?
In our current setup we're experiencing issues with Sentry not recognizing the source file paths and pointing it to the build files instead when we remove our source maps 🙃

[thomasverleye]

First, thanks for sharing!

When a server error occurs, Sentry cannot figure out which source file it is occurring and we end up seeing error messages mapped on the build files.

I've found an issue on Sentry their repo that shows the exact issue I'm talking about:
getsentry/sentry-javascript#5486
Matter of fact, the sentry-upload-sourcemaps does not upload the server scripts at all!

I've tried several things:

• Uploading the server sourcemaps through sentry-cli instead
• Keep the server sourcemap file in place so Sentry could pick them up.
  Both these techniques have failed and I am still seeing the errors mapped in the build files instead of the source files 🙃

@convcha, Did you get any server errors with a mapped source on your Sentry project?

[convcha]

Hmmmm...yes, server-side errors are displayed with source mapping.

In my environment, server-side source maps are also uploaded by sentry-upload-sourcemaps (from @sentry/remix). Are Sentry releases and source maps accurately tied together?

https://docs.sentry.io/platforms/javascript/sourcemaps/troubleshooting_js/
I recommend reading this article if you have not already done so.

[convcha]

I don't know if this will help...but this is what it looks like on the Sentry's management console.

Artifacts

``` ARTIFACT FILE SIZE ~/build/_shared/ImageComponent-VLMSATZS.js 13 minutes ago none 7.4 KiB

~/build/_shared/ImageComponent-VLMSATZS.js.map
13 minutes ago
none
27.5 KiB

~/build/_shared/PollComponent-XMK2NKXP.js
13 minutes ago
none
2.9 KiB

~/build/_shared/PollComponent-XMK2NKXP.js.map
13 minutes ago
none
9.7 KiB

~/build/_shared/TableComponent-AYHHIRYY.js
13 minutes ago
none
18.8 KiB

~/build/_shared/TableComponent-AYHHIRYY.js.map
13 minutes ago
none
79.3 KiB

~/build/_shared/chunk-2LOM2E4Y.js
13 minutes ago
none
752 B

~/build/_shared/chunk-2LOM2E4Y.js.map
13 minutes ago
none
51 B

~/build/_shared/chunk-5K73UEXS.js
13 minutes ago
none
131.7 KiB

~/build/_shared/chunk-5K73UEXS.js.map
13 minutes ago
none
317.1 KiB

~/build/_shared/chunk-7PHAZF6N.js
13 minutes ago
none
1.3 KiB

~/build/_shared/chunk-7PHAZF6N.js.map
13 minutes ago
none
3.4 KiB

~/build/_shared/chunk-BS7MEYWA.js
13 minutes ago
none
96.6 KiB

~/build/_shared/chunk-BS7MEYWA.js.map
13 minutes ago
none
560.8 KiB

~/build/_shared/chunk-DA3W4QSV.js
13 minutes ago
none
5.1 KiB

~/build/_shared/chunk-DA3W4QSV.js.map
13 minutes ago
none
8.7 KiB

~/build/_shared/chunk-E6IXLIKP.js
13 minutes ago
none
55.7 KiB

~/build/_shared/chunk-E6IXLIKP.js.map
13 minutes ago
none
139.3 KiB

~/build/_shared/chunk-IBSQY42U.js
13 minutes ago
none
81.7 KiB

~/build/_shared/chunk-IBSQY42U.js.map
13 minutes ago
none
203.7 KiB

~/build/_shared/chunk-IONCN7GT.js
13 minutes ago
none
966 B

~/build/_shared/chunk-IONCN7GT.js.map
13 minutes ago
none
2.7 KiB

~/build/_shared/chunk-IY7JNEPH.js
13 minutes ago
none
47.9 KiB

~/build/_shared/chunk-IY7JNEPH.js.map
13 minutes ago
none
262.3 KiB

~/build/_shared/chunk-KZWJGMOX.js
13 minutes ago
none
7.6 KiB

~/build/_shared/chunk-KZWJGMOX.js.map
13 minutes ago
none
17.4 KiB

~/build/_shared/chunk-L7EGJHIN.js
13 minutes ago
none
20.0 KiB

~/build/_shared/chunk-L7EGJHIN.js.map
13 minutes ago
none
153.0 KiB

~/build/_shared/chunk-LUELBJX4.js
13 minutes ago
none
29.1 KiB

~/build/_shared/chunk-LUELBJX4.js.map
13 minutes ago
none
72.6 KiB

~/build/_shared/chunk-SJ325QDX.js
13 minutes ago
none
158 B

~/build/_shared/chunk-SJ325QDX.js.map
13 minutes ago
none
242 B

~/build/_shared/chunk-SYPFSRZR.js
13 minutes ago
none
62.1 KiB

~/build/_shared/chunk-SYPFSRZR.js.map
13 minutes ago
none
234.1 KiB

~/build/_shared/chunk-TOYMEJAN.js
13 minutes ago
none
1.3 KiB

~/build/_shared/chunk-TOYMEJAN.js.map
13 minutes ago
none
1.8 KiB

~/build/_shared/chunk-TSTLNUZB.js
13 minutes ago
none
158 B

~/build/_shared/chunk-TSTLNUZB.js.map
13 minutes ago
none
239 B

~/build/_shared/chunk-UC7JZ3SA.js
13 minutes ago
none
1.6 KiB

~/build/_shared/chunk-UC7JZ3SA.js.map
13 minutes ago
none
2.3 KiB

~/build/_shared/chunk-UM63KFF2.js
13 minutes ago
none
1.2 KiB

~/build/_shared/chunk-UM63KFF2.js.map
13 minutes ago
none
1.7 KiB

~/build/_shared/chunk-VTPDSODM.js
13 minutes ago
none
2.4 KiB

~/build/_shared/chunk-VTPDSODM.js.map
13 minutes ago
none
9.6 KiB

~/build/_shared/chunk-WQ2YSAM4.js
13 minutes ago
none
6.4 KiB

~/build/_shared/chunk-WQ2YSAM4.js.map
13 minutes ago
none
27.9 KiB

~/build/_shared/emoji-list-TGICEH77.js
13 minutes ago
none
269.3 KiB

~/build/_shared/emoji-list-TGICEH77.js.map
13 minutes ago
none
547.1 KiB

~/build/entry.client-L6TPAUYE.js
13 minutes ago
none
726 B

~/build/entry.client-L6TPAUYE.js.map
13 minutes ago
none
2.0 KiB

~/build/manifest-A133C828.js
13 minutes ago
none
3.8 KiB

~/build/root-TLJWFCKF.js
13 minutes ago
none
2.4 KiB

~/build/root-TLJWFCKF.js.map
13 minutes ago
none
11.3 KiB

~/build/routes/__authenticated-FLGMI7LD.js
13 minutes ago
none
510 B

~/build/routes/__authenticated-FLGMI7LD.js.map
13 minutes ago
none
1.1 KiB

~/build/routes/__authenticated/$username-APMJRBM7.js
13 minutes ago
none
474 B

~/build/routes/__authenticated/$username-APMJRBM7.js.map
13 minutes ago
none
891 B

~/build/routes/components-RTEJ5BXP.js
13 minutes ago
none
1.0 KiB

~/build/routes/components-RTEJ5BXP.js.map
13 minutes ago
none
1.4 KiB

~/build/routes/index-RBAVAO2L.js
13 minutes ago
none
1.6 KiB

~/build/routes/index-RBAVAO2L.js.map
13 minutes ago
none
3.0 KiB

~/build/routes/playground/editor-DEX2OH2L.js
13 minutes ago
none
197.2 KiB

~/build/routes/playground/editor-DEX2OH2L.js.map
13 minutes ago
none
645.7 KiB

~/build/routes/playground/index-BKQVL6MD.js
13 minutes ago
none
113.9 KiB

~/build/routes/playground/index-BKQVL6MD.js.map
13 minutes ago
none
653.4 KiB

~/build/routes/playground/meilisearch-BREKZXIC.js
13 minutes ago
none
175.2 KiB

~/build/routes/playground/meilisearch-BREKZXIC.js.map
13 minutes ago
none
805.6 KiB

~/build/routes/private-7X2LUKJ5.js
13 minutes ago
none
350 B

~/build/routes/private-7X2LUKJ5.js.map
13 minutes ago
none
434 B

~/build/routes/sign-in-GLHMIR77.js
13 minutes ago
none
298 B

~/build/routes/sign-in-GLHMIR77.js.map
13 minutes ago
none
51 B

~/build/routes/sign-up-DOD7PKAR.js
13 minutes ago
none
298 B

~/build/routes/sign-up-DOD7PKAR.js.map
13 minutes ago
none
51 B

~/build/routes/sign-up/sso-callback-SYEQVBWY.js
13 minutes ago
none
384 B

~/build/routes/sign-up/sso-callback-SYEQVBWY.js.map
13 minutes ago
none
408 B

</details>

[thomasverleye]

So, I figured out the sentry-upload-sourcemaps script does not upload anything from the /build folder.
It actually only upload the /public/build folder and that's it.

But, we did remove those sourcemaps from that folder as well!

As i could see from your script I finally figured out that it has been working for you because the /build/index.js.map does not get removed. I've removed my removal script and now I am getting these errors with correct sourcemapping as well :-)

My only doubt here is, is it secure to keep the server script here, from what I suspect it shouldn't be an issue as the /build folder of the server scripts aren't publicly visitable.
@kiliman or @sergiodxa could you confirm that keeping the /build/index.js.map file on production is in fact not an security issue?

[kiliman]

The server build sourcemap should be fine as it's never requested nor sent to the client. However, any exceptions you may have on the server will send the the mapped stacketrace, which I think is a bug. In production, Remix does send a plain Response('Unexpected Error', 500), however it also serializes the Error object. I think the stack property should be removed before serializing. Server stacktraces should only be available in server logs or monitoring service. Not sent to the client.

[Hansenq]

This fixed it for me. Instead of doing (in package.json)

"build": "remix build --sourcemaps && sentry-upload-sourcemaps --release $SENTRY_RELEASE",

I do the following:

"build": "remix build --sourcemap",
"upload-sourcemaps": "sentry-upload-sourcemaps --release $SENTRY_RELEASE --urlPrefix \"~/client-build/\" --buildPath \"build/client\" && sentry-upload-sourcemaps --release $SENTRY_RELEASE --urlPrefix \"~/server-build/\" --buildPath \"build/server\" --deleteAfterUpload false"

and then during the build process, I do npm run build and npm run upload-sourcemaps. I also do not delete the *.map files in build/ since as mentioned above, it should be safe to leave the server source maps in that folder. My source maps (.ts files) now show up in Sentry. I don't see where the urlPrefix really impacts things, but it can't hurt.

The only other issue that affects me is that Sentry wraps Remix's requestHandler in @sentry/remix. Remix throws a 404 Error when someone visits a route that isn't declared; however, Sentry doesn't treat a 404 Error as a valid response and instead passes a 500 error to the client. This is annoying but I haven't figured out how to solve this yet. If anyone has any tips, I'd appreciate that.

[info]ErrorResponseImpl {
[info]  status: 404,
[info]  statusText: 'Not Found',
[info]  internal: true,
[info]  data: 'Error: No route matches URL "/error"',
[info]  error: Error: No route matches URL "/error"
[info]      at getInternalRouterError (/app/node_modules/@remix-run/router/router.ts:4483:5)
[info]      at Object.query (/app/node_modules/@remix-run/router/router.ts:2933:19)
[info]      at handleDocumentRequestRR (/app/node_modules/@remix-run/server-runtime/dist/server.js:180:35)
[info]      at requestHandler (/app/node_modules/@remix-run/server-runtime/dist/server.js:105:24)
[info]      at /app/node_modules/@sentry/src/utils/instrumentServer.ts:476:36
[info]      at /app/node_modules/@sentry/src/async/hooks.ts:47:14
[info]      at AsyncLocalStorage.run (node:async_hooks:346:14)
[info]      at Object.runWithAsyncContext (/app/node_modules/@sentry/src/async/hooks.ts:46:25)
[info]      at Object.runWithAsyncContext (/app/node_modules/@sentry/src/hub.ts:689:36)
[info]      at /app/node_modules/@sentry/src/utils/instrumentServer.ts:439:36
[info]}
[info][Error: Unexpected Server Error]
[info]GET /error 500 - - 78.008 ms

Hopefully this helps someone else, or someone can point out something I'm doing incorrectly!