t3-oss / t3-env

https://env.t3.gg
MIT License
2.67k stars 86 forks source link

Bundling Next.JS app results in environment key names exposed in the bundled js chunks #246

Closed codesfromshad closed 3 months ago

codesfromshad commented 3 months ago

While process.env.SECRET slaps the "verysecretivesecret" in the chunks, t3-env exposes the name of the key "SECRET" in the chunked js. Not sure if that's a good thing or a bad thing. I would've to see a minified reference to my secret without exposing the key name. Is that possible?

// Taken from the `sources` tab on `Chrome.exe`
...
      var r = n(7437),
        i = n(6463),
        E = n(2265),
        a = n(8621),
        l = n(9772),
        c = n(5566);
      let s = (0, a.D)({
        server: {
          DATABASE_URL: l.z.string().url(),
          SECRET_2: l.z.string(),
          NODE_ENV: l.z
            .enum(["development", "test", "production"])
            .default("development"),
          SECRET_3: l.z.string(),
          DISCORD_CLIENT_ID: l.z.string(),
          DISCORD_CLIENT_SECRET: l.z.string(),
        },
        client: {
          NEXT_PUBLIC_HE_HE_KEY: l.z.string(),
          NEXT_PUBLIC_HAYA_HUYA_KEY: l.z.string(),
        },
        runtimeEnv: {
          DATABASE_URL: c.env.DATABASE_URL,
          SECRET_2: c.env.SECRET_2,
          NODE_ENV: "production",
          SECRET_3:
            c.env.SECRET_3,
          NEXT_PUBLIC_HE_HE_KEY:
            "heheIamAPublicKey",
          NEXT_PUBLIC_HAYA_HUYA_KEY:
            "verysecretivesecret",
          DISCORD_CLIENT_ID: c.env.DISCORD_CLIENT_ID,
          DISCORD_CLIENT_SECRET: c.env.DISCORD_CLIENT_SECRET,
        },
        skipValidation: !!c.env.SKIP_ENV_VALIDATION,
        emptyStringAsUndefined: !0,
      });
      n(4590);
...
adelrodriguez commented 3 months ago

The docs mention this. If you don't want the names of your server variables leaked in your bundle, you should split your schema into a client schema and a server schema: https://env.t3.gg/docs/nextjs#create-your-schema

codesfromshad commented 3 months ago

Oh, yes! It is mentioned in the docs here. Thanks, @adelrodriguez! Closing the issue then.