Is there a way to stop source filenames from appearing in webpack output even when using Terser for minification?
Illustration
After minifying my production React app build, the resulting .js
output file still contains original source filenames rather than obfuscated ones.
Snippet:
[...]
({"../js/dashboard/lib/MyApiClient.js":function(e,t,n){"use
strict";n.r(t),n.d(t,"default",function(){return c});var
o=n("../node_modules/axios/index.js"),r=n.n(o),
s=n("../node_modules/@sentry/browser/esm/index.js");
[...]
Observations:
- A module named
MyApiClient.js
is visible in the proprietary code - Dependencies like
axios
andSentry
are being used
Webpack setup
This snippet shows the relevant part of our webpack configuration for production:
optimization: {
minimize: true,
minimizer: [
new TerserPlugin({
sourceMap: true,
extractComments: false,
terserOptions: {
output: {
comments: false,
},
},
}),
],
},
The Issue
I'm worried about the potential information leakage regarding our app's internal architecture through these clear source filenames which I couldn't figure out how to hide within the webpack or Terser settings.
While the examples shown may seem harmless, exposing too much structural detail could make it easier for others to analyze and uncover hidden features.
Appreciate any advice or tips!