Thanks for filing the issue!

@Reporter: Could you please provide sample Test File/URL that reproduces the issue which help in further triaging the issue in better way. If possible provide screencast of the issue which help in better understanding.

Thanks!

I've noticed a similar behaviour by the Developer Tools in Chrome when it gets the js.map files automatically: it doesn't send all the cookies to the server.

The application I'm using sets two cookies: JSESSIONID and SESSION. The Cookie header sent by a request made normally by the application (whether direct request, img tag or XMLHttpRequest) sends the two cookies like so:

    Cookie: JSESSIONID=abc...; SESSION=xyz...
	
(where "abc..." and "xyz..." are string values approximately 50-characters long).

However, when the Developer Tools make the GET request to ".js.map" files automatically, only the JSESSIONID cookie is sent. The SESSION cookie isn't sent. (A side effect in this case is that the server invalidates the session in this case, which logs out users when simply opening the Dev Tools, or shortly after doing so.)

This problem doesn't happen when making the same GET requests to the ".js.map" resources explicitly, so this seems specific to the Developer Tools.


This is tested using Chrome Version 71.0.3578.98 (Official Build) (64-bit). I've had to debug this server-side, since those requests don't appear in the Network tab of the Dev Tools.


I'm not sure how to trigger these requests explicitly in the Dev Tools, since they happen behind the scenes, but it happens often enough when reloading a page that has .js scripts and potential matching .js.map files, while the Dev Tools are open.

Interestingly, getting logged out while opening the devtools due to non-authenticated requests is the same problem we are experiencing.

I tested this and newer versions of IE and Edge behave in the same way as Chrome is behaving. I don’t know if that means the behavior is intentional.

Same issue here, with plain regular javascript sourcemap files (it does not only happen for TypeScript).