yes, adding the NEXT_PUBLIC prefix will expose your env secret to the client, browser

what's the best approach?

rather than call the API directly in your frontend, create an API route and use your env variable without the NEXT_PUBLIC prefix inside

then call your api in your frontend as in /api/auth

that way, your secret will remain on the server

yah i did that but what i'm looking for is little login page that sends a API request with my secret passcode to the backend + to have like password that stored in the frontend to verify

i know it's not good approach but it's only 1 user who should be able to be able to do these stuff

well, you’ll probably have to add the secret to your api route and then compare that the password in your post request in your login form is the same as the one you hardcoded in your api route

Yah i did do that but I'm wondering will someone looking in the code would know the value

oh okay. from your implementation, yes

yah so i'm wondering what's the best approach to change the NEXT_PUBLIC_ANALYSTICS_PASSCODE or is there a better way?

rather than pass the env to your form, why not add a field where you can type the password out

and in your api route use the env without the prefix

there will be that but i want requests to post/delete/edit only come from that website endpoint if their passowrd and username is correct

so for example if someone try to make delete request and they don't know the passcode their request will be denied

or is there better approach to not let any request come from outside the website?

yes i believe you can use a middleware for that

i haven’t used it much since Next 13 but i’m sure you’ll find sth useful in the docs

the new docs are hurting my brain lol and since the newsest update doesn't have much content about it it's little hard

sorry bout that

is there a reason you’re not using a database for this though? like a simple google auth with firebase/supabase?

tbh i'm trying to implement nextjs with my knowledge

i think i will use ur approach best, i will use username and password and save it in the local storage and check if the username and password is matching in every request

and send local storage in every request since after he login in once it's on his client only and use env file in the backend

Thank you for the help and the ideas!

also ur website is really clean and cool!

this approach will be problematic down the line 😅

i think your best bet is still a service like firebase/supabase

thank youuu! 😄

it's not like i want more than 1 person to use the admin panel

that's why i want to use this approach

if i have websitte with login and stuff i'd use that but it's more of showcases and the person that want the website want to be able to upload posts

oh alright then. if you’re sure you don’t have sensitive info that can be compromised then it’s cool. this approach works

yah it's just showcasing their work and that's about it

alright cool

all the best!

thank you again for your time!