astro/public-env-secret

Dlaczego

Astro exposes only PUBLIC_ variables to client-side code, and it does so by writing their values into the bundle. A name such as PUBLIC_STRIPE_SECRET_KEY publishes the key to every visitor, in every island and script that reads it, and in every cached copy of that bundle.

Poprawka

Rename it without the prefix and read it only in server code (front matter of an on-demand page, an endpoint, an action). Better, declare it in the env.schema of astro.config as envField.string({ context: 'server', access: 'secret' }) and import it from astro:env/server; Astro then refuses to put it in a client bundle. Rotate a key that was ever deployed under a public name.

Przykłady

---
// bad
const stripe = new Stripe(import.meta.env.PUBLIC_STRIPE_SECRET_KEY)
// good
import { STRIPE_SECRET_KEY } from 'astro:env/server'
const stripe = new Stripe(STRIPE_SECRET_KEY)
---

Źródła

• Astro docs, Using environment variables (PUBLIC_ prefix and astro:env)

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain astro/public-env-secret