Secrets exposed or not?
Unanswered
Barbary Lion posted this in #help-forum
Barbary LionOP
Hello, would you be able to shed some light on this problem? In NextJs secrets are divided into client and backend secrets, as it is said in the docs https://nextjs.org/docs/pages/building-your-application/configuring/environment-variables#bundling-environment-variables-for-the-browser if you prefix the variable with NEXTPUBLIC this variable will end up in the frontend bundle.
Also here in the docs https://nextjs.org/docs/pages/api-reference/next-config-js/env it says that the way it works is that variables are replaced at build time with the value of the env variable.
We have a problem in a project that variables not marked as NEXTPUBLIC are undefined in the production build, we would have to provide them to the docker and we want to avoid that, and my question is, if i name variable NEXT_PUBLIC_SOME_SECRET, but not use it in the frontend code, only in the api route, will the value be just replaced with the value of the variable by the bundler at build time, or would those really end up in the frontend bundle?
Also here in the docs https://nextjs.org/docs/pages/api-reference/next-config-js/env it says that the way it works is that variables are replaced at build time with the value of the env variable.
We have a problem in a project that variables not marked as NEXTPUBLIC are undefined in the production build, we would have to provide them to the docker and we want to avoid that, and my question is, if i name variable NEXT_PUBLIC_SOME_SECRET, but not use it in the frontend code, only in the api route, will the value be just replaced with the value of the variable by the bundler at build time, or would those really end up in the frontend bundle?
2 Replies
They should still get exposed to the 'client-side' if im correct.
If the variable in undefined maybe you are trying to use variables not prefixed with NEXT_PUBLIC in the client-side/client component etc.
If the variable in undefined maybe you are trying to use variables not prefixed with NEXT_PUBLIC in the client-side/client component etc.
Barbary LionOP
Hi, no i use it in api route, in dev it works, but on staging and prod (basicaly in docker) it does not, but this stage is nhandled by devops and we don't want to be having to make a query to them with sucha a minor stuff