langgenius/webapp-conversation
1
0
Fork 0
mirror of https://github.com/langgenius/webapp-conversation.git synced 2026-07-22 01:15:25 -04:00
Code Issues 9 Packages Projects Releases Wiki Activity

The NEXT_PUBLIC_ prefix is ​​unnecessarily added to the environment variables, and the APP_KEY is in a public state. #63

New Issue
Closed
opened 2026-02-16 10:15:59 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 10:15:59 -05:00
Owner
Copy Link
Copy Source

Originally created by @fujita-h on GitHub (Jan 19, 2025).

Sumamry

Environment variables with NEXT_PUBLIC_ are expanded at build time, so they should not be assigned to credentials, etc.

Current Behavior

NEXT_PUBLIC_APP_KEY is stored in the variable below.

https://github.com/langgenius/webapp-conversation/blob/9d2d092e9e652c92bdf4234b18216b151ac2bd17/config/index.ts#L3

In addition, this API_KEY is loaded in the client component.

https://github.com/langgenius/webapp-conversation/blob/9d2d092e9e652c92bdf4234b18216b151ac2bd17/app/components/index.tsx#L22

This makes the API_KEY (=APP_KEY) public.

Image

Depending on usage, API keys managed by Dify users may be leaked to third-party users.

Note

The Next.js documentation on this topic is here.

Originally created by @fujita-h on GitHub (Jan 19, 2025). ## Sumamry Environment variables with `NEXT_PUBLIC_` are expanded at build time, so they should not be assigned to credentials, etc. ## Current Behavior `NEXT_PUBLIC_APP_KEY` is stored in the variable below. https://github.com/langgenius/webapp-conversation/blob/9d2d092e9e652c92bdf4234b18216b151ac2bd17/config/index.ts#L3 In addition, this `API_KEY` is loaded in the client component. https://github.com/langgenius/webapp-conversation/blob/9d2d092e9e652c92bdf4234b18216b151ac2bd17/app/components/index.tsx#L22 This makes the `API_KEY` (=`APP_KEY`) public. ![Image](https://github.com/user-attachments/assets/527e933e-f664-40ad-8a8e-fdc6ed07dd7f) Depending on usage, API keys managed by Dify users may be leaked to third-party users. ## Note The Next.js documentation on this topic is [here](https://nextjs.org/docs/14/pages/building-your-application/configuring/environment-variables#bundling-environment-variables-for-the-browser).
yindo closed this issue 2026-02-16 10:15:59 -05:00
yindo commented 2026-02-16 10:15:59 -05:00
Author
Owner
Copy Link
Copy Source

@zhaoxiaohai commented on GitHub (Feb 8, 2025):

I urgently need to solve this problem.

@zhaoxiaohai commented on GitHub (Feb 8, 2025): I urgently need to solve this problem.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
cant reproduce
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/webapp-conversation#63
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?