Next.js Discord

Discord Forum

secrets from env file defined in Next config defined leaking in client.

Answered
Gray Kingbird posted this in #help-forum
Open in Discord
Gray KingbirdOP
I am using Nextjs 13.4.3, I have defined variables in next config coming from env file like:
const nextConfig = {
  env: {
    //Google MAPS API KEY
    PLACES_API_KEY: process.env.PLACES_API_KEY,
  },

the issue is it is getting leaked in the client, what can be solution?
Answered by "use php"
Summary:
- Variables were getting leaked to client because it was a hook running on client side
View full answer

43 Replies

Gray KingbirdOP
cant share the code as it contains secrets, but it is like this:

.env
#Google MAPS API KEY
PLACES_API_KEY="Key"


next config
/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  env: {
    //Google MAPS API KEY
    PLACES_API_KEY: process.env.PLACES_API_KEY,
  },
  images: {
    domains: [
    ],
  },
};

module.exports = nextConfig;
Sun bear
I have never used nextConfig for defining env variables. Can't you just access them from app by:

process.env.ENV_VARIABLE
Code where you are using the api ke
I wasn't even sure why you were using config for env variables
@Gray Kingbird I am using Nextjs 13.4.3, I have defined variables in next config coming from env file like: js const nextConfig = { env: { //Google MAPS API KEY PLACES_API_KEY: process.env.PLACES_API_KEY, }, the issue is it is getting leaked in the client, what can be solution?
Sun bear
Try to create /src/constants/env.ts file, and make your env variables type-safe:

const PLACES_API_KEY = process.env.PLACES_API_KEY ?? null
const BASE_URL = process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"

export {PLACES_API_KEY, BASE_URL}


If you import non-prefixed constant in client component it will be null since it's not exposed to the client, and in server components it will work as usual but will be type-safe. No need for using next.config.js.
Gray KingbirdOP
the next verison is 13.4.3 so there are no server components
Sun bear
if you are using app router there are
Gray KingbirdOP
the code is very old, i came up with this solution of:
shifting all the code which needs env to api folder, then hitting it to get the data

but thats just alot of manual work
any other alternative?
@Sun bear if you are using app router there are
Gray KingbirdOP
can we use app router in next 13.4.3?
Sun bear
Yes I believe it's the first version in which it is stable
Gray KingbirdOP
i am using pages directory btw
so i dont have any src folder
creating a high level constants file will work?
Sun bear
I think it will
Gray KingbirdOP
i still can find my key in the sources folder
by doing this:
export const PLACES_API_KEY = process.env.PLACES_API_KEY;


axios
    .get(
      `https://maps.googleapis.com/maps/api/geocode/json?latlng=${latitude},${longitude}&key=${PLACES_API_KEY}`
    )
Sun bear
can you share your entire file where you are using the key
Gray KingbirdOP
.env
PLACES_API_KEY=key


constants.js
export const PLACES_API_KEY = process.env.PLACES_API_KEY;


customHook.js
import { PLACES_API_KEY } from "@/constants";

 axios
    .get(
      `https://maps.googleapis.com/maps/api/geocode/json?latlng=${latitude},${longitude}&key=${PLACES_API_KEY}`
    )
this is it
keys getting exposed
Gray KingbirdOP
any thing?
@"use php" Can you share more part of your code, like where you are using this function
Gray KingbirdOP
custom hook file is where i am using the env variable
let me share the next config file
@Gray Kingbird custom hook file is where i am using the env variable
It'll obv be visible to client, because hooks are running on client side
Gray KingbirdOP
so basically what i want is

i want to call an api from client using a env variable but don't want that variable to he leaked on the client side
is it possible, or not, i dont think so
and yes, its a xy problem https://xyproblem.info/
Gray KingbirdOP
got it, thanks
for now sticking to shifting the code to api folder
Summary:
- Variables were getting leaked to client because it was a hook running on client side
Answer
@Gray Kingbird so basically what i want is i want to call an api from client using a env variable but don't want that variable to he leaked on the client side
@Gray Kingbird are you gonna call api from your components or pages? the correct way to do data fetch is on the server side, in page router you have next.js specific functions getStaticProps(), getServersideProps() there you can access to the envs