生产中的源地图。 他们有必要吗？

Question

I have a gulp task created with a Node Module which invoke the GCC compiler whom reduce my JS code a little bit. It's node-minify.

The problem is that it's not "pipe-out" and I can't use pipes to create the sourcemaps created previously with "uglify" gulp module ("gulp-uglify") on other task.

gulp.task('gcc', function () {
    new compressor.minify({
        type: 'gcc',
        fileIn: mainFileBundled,
        fileOut: mainFileBundled2,
        callback: function (err, min) {
            console.log(err);
            //console.log(min);
        }
    });
});

It would be the last task to do before put the code on production with the intention to minify even more the js files.

So my question is. It would be necessary to put source maps on production with the premise that we want to protect the code as much as posible?

Answer 1

No, you only need source maps if you want to use them to debug the code.

---

Side note: Don't worry about the //# sourceMappingURL=... line in the file (if it survives your minification process). Browsers will only attempt to download the source map if you open dev tools and go to the code panel, so you won't be getting 404s for the missing maps in normal use. It's not ideal, and hopefully your process removes them, but if they're there it's mostly harmless. Of course, if someone did open the dev tools and go to the code panel, yes, the browser would try to get the file (and presumably fail, as you haven't put them on production).

Answer 2

The problem is that it's not "pipe-out" and I can't use pipes to create the sourcemaps created previously with "uglify" gulp module ("gulp-uglify") on other task.

I do not fully understand the problem you describe here, but it seems to be irrelevant to your actual question, so if you would like help with generation of source maps, please open another question about that.

As to your actual question:

So my question is. It would be necessary to put source maps on production with the premise that we want to protect the code as much as posible?

Firstly: No, there is no necessity for source maps whatsoever. You need not even generate them, unless you want to use them for debugging. And if you do, you will hamper yourself by not making them available.

Secondly: Protecting what is essentially an open piece of code is kind of moot. Of course, you can obfuscate what your application does, but a capable and motivated adversary will penetrate that in any case, and there is absolutely nothing oyu can do to prevent that. If you are worried about security flaws in your application, audit it for those and fix what you find! That will actually help you.