firebase deploy of create react app exposes all js code in the source tab?

Question

I have compiled my app via create react app: yarn build //code is minified and obfuscated as expected

I have then deployed the app via both firebase serve and firebase deploy.

my firebase.json:

{
  "database": {
    "rules": "database.rules.json"
  },
  "hosting": {
    "public": "build",
    "rewrites": [
      {
        "source": "**",
        "destination": "/index.html"
      }
    ]
  }
}

All is deployed "almost as expected", with 2 caveats:

inside Chrome developer tools/ Sources tab, my entire js codebase is listed with no minification and or obfuscation!
my fonts are not being deployed as the media folder doesnt seem to transfer

The structure looks nothing like the build folder which contains the media... (necessary for fonts):

Am I setting something up incorrectly, deploying the wrong folder or possibly not ignoring something I should be? Exposing the entire js stack unminified and or without any obfuscation seems very "un-secure"...

Again, and as always any and all direction is greatly appreciated!

You've configured Firebase Hosting to deploy whatever is in your build directory. So it seems like you have your raw source code end up in that directory. How that happens is unrelated to Firebase, but given this first line of the create-react-app tag seems like it might be expected behavior for that: "create-react-app is a starter-kit for creating React apps with no build configuration." — Frank van Puffelen
– Frank van Puffelen, Commented Jun 24, 2017 at 17:32
Thanks for the reply! I would tend to agree and it looks as though that's precisely what is happening, however that build folder is what is generated and has no raw source code in it (at least as I see it in my ide)... I will investigate further in that build directory, but something seems a miss... The create react app builds for production out of the box, yet has an eject feature to configure webpack as you see fit. I was trying to avoid configuration of webpack until it was absolutely nessesary. I hope that day isn't today! — studiobrain
– studiobrain, Commented Jun 24, 2017 at 17:40
I can confirm that running the build via local server serve -s build has all source files included, so this absolutely rules out firebase. Any create-react-app peeps wana chime in? — studiobrain
– studiobrain, Commented Jun 24, 2017 at 17:55
...for whats its worth, it seems to be the sourcemaps: github.com/facebookincubator/create-react-app/issues/1341 — studiobrain
– studiobrain, Commented Jun 24, 2017 at 18:13
Allbeit not sexy at all the current workaround is to remove the sourcemaps: rm build/static/js/*.map rm build/static/css/*.map — studiobrain
– studiobrain, Commented Jun 24, 2017 at 18:24

Brian Burns · Accepted Answer · 2018-02-19 11:12:40Z

4

Strongly advise to refer to the create-react-app github discussion here about this matter but as a quick workaround you can add the following to your package.json scripts:

"scripts": {
    ...
    "build": "npm run build-css && react-scripts build && yarn run delete-maps",
    "delete-maps": "rm ./build/static/js/*.map && rm ./build/static/css/*.map",
    ...
}

This will however in the short run remove all of your source code from the Source tab in developer tools...

edited Feb 19, 2018 at 11:12

Brian Burns

22.4k10 gold badges93 silver badges80 bronze badges

answered Jun 24, 2017 at 19:32

studiobrain

1,2352 gold badges17 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

bsr · Accepted Answer · 2019-11-30 03:44:37Z

2

Prefixing GENERATE_SOURCEMAP=false to your build target works too (which obviously doesn't generate sourcemap). In package.json file.

GENERATE_SOURCEMAP=false react-scripts build

answered Nov 30, 2019 at 3:44

bsr

59k88 gold badges220 silver badges322 bronze badges

Collectives™ on Stack Overflow

firebase deploy of create react app exposes all js code in the source tab?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related