TYPO3 Core

For instance, Chrome tries to load a .map file for JS files, which does not exist in the Core sources.

The current situation (docroot/.htaccess and docroot/typo3/.htaccess) leads to the situation that such requests are rewritten to the typo3/index.php file, causing the full BE (or Login) to be returned instead of a 404 HTTP error.
A side effect is that a PHP session cookie (from the LoginController) is created, when only accessing the Install Tool.

The reason for that problem is that the option RewriteOptions inherit in typo3/.htaccess literally copies the rewrite rules of the parent .htaccess files into the current one. This is necessary to have TYPO3_CONTEXT and versioned asset files working.
Unfortunately the rule to block rewriting for files in typo3/ does not match in the context of typo3/.htaccess as the path to the requested file does not contain the typo3/ segment anymore, as we are in that directory already.

The only solution is to either get rid of the .htaccess file in typo3/ or to block .map files explicitly.

As a first fix we discard requests to .map.