[docs]: Clarify env variables are NOT "SECRET"

The usage of REACT_APP_SECRET_CODE in Adding Custom Environment Variables is misleading given that there are no secrets in the front end.

Should I open a PR that changes all to REACT_APP_NOT_SECRET_CODE?

Also, should there be a warning box toward the top about being careful not to expose secrets?

During the build, process.env.REACT_APP_SECRET_CODE will be replaced with the current value of the REACT_APP_SECRET_CODE environment variable

Documentation says it explicitly, that this value will end up in the result bundle.

@miraage

@miraage I don't believe this makes it clear that secrets will be exposed. It requires some deduction and reading. Here's an example warning message:

Don't store any secrets (such as API keys) in your React app as they'll be included in the build (meaning they can be read by anyone looking at your script/html files in dev tools). Instead, you should send requests to a separate backend (which stores your secrets) and send back the response to your React app.

I think this is an important distinction that should be immediately obvious when looking at the docs, especially for beginners. Unfortunately some misinformation is being spread online, so I think it's safe to assume that people are not finding this clear.

What's the downside of adding NOT?

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

@JBallin

Would you like to submit a PR to update the docs @JBallin?

@ianschmitz

@ianschmitz would love to! Was just waiting for agreement/feedback on the following:

Changing all to REACT_APP_NOT_SECRET_CODE
Adding a warning at the top about secrets
The following warning message:

Don't store any secrets (such as API keys) in your React app as they'll be included in the build (meaning they can be read by anyone looking at your script/html files in dev tools). Instead, you should send requests to a separate backend (which stores your secrets) and send back the response to your React app.

Sounds reasonable. Let's get a PR going and we can get some feedback from the others in there. Thanks!

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

There's an open PR in progress: #6062

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

There's an open PR in progress: #6062

Waiting for a response from maintainers.

[docs] Warn/clarify that env vars are NOT "SECRET" (#6062)

[docs] Warn/clarify that env vars are NOT "SECRET" (react#6062)

Fork update (#6)

Wizard to 3.0.1 (#28)

Navigation Menu

Repository navigation

[docs]: Clarify env variables are NOT "SECRET" #5676

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[docs]: Clarify env variables are NOT "SECRET" #5676

Description

Activity

miraage commented on Nov 2, 2018

JBallin commented on Nov 2, 2018

stale commented on Dec 2, 2018

ianschmitz commented on Dec 2, 2018

JBallin commented on Dec 2, 2018

ianschmitz commented on Dec 2, 2018

stale commented on Jan 1, 2019

JBallin commented on Jan 2, 2019

stale commented on Feb 7, 2019

JBallin commented on Feb 9, 2019

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions