#Help with .env safety (REACT).

9 messages · Page 1 of 1 (latest)

chrome shard
#

Is it safe in using data read from env files in frontend part of a react app (build file)?

#

I have a react app with a file named supabase.js (./src/database/supabase.js)

import { createClient } from '@supabase/supabase-js'

const { REACT_APP_SUPABASE_URL, REACT_APP_SUPABASE_API_KEY } = process.env;
const supabaseClient = createClient(REACT_APP_SUPABASE_URL, REACT_APP_SUPABASE_API_KEY);

export default supabaseClient;

Is it safe to use the env in frontend part? I am using backend as a service from supabase.

But after building the app, i noticed that the env file is not needed for the app to work which means it is embedded in the code? is it hackable?

#

i implemented a login feature

#

and even after removing env file it works fine which means it is embedded in the code.

real thunder
#

It is not

#

If you serve envs to the frontend they will be visible

#

In a way you described

#

Login is usually run in the backend, for obvious security issues

real thunder