Skip to content

fix: stop exposing client-side tokens #1329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Abhash-Chakraborty wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −46
Open

fix: stop exposing client-side tokens #1329

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions docusaurus.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,15 +267,12 @@ const config: Config = {
],
],

// ✅ Add this customFields object to expose the token to the client-side
customFields: {
gitToken: process.env.DOCUSAURUS_GIT_TOKEN,
// Shopify credentials for merch store
SHOPIFY_STORE_DOMAIN:
process.env.SHOPIFY_STORE_DOMAIN || "junh9v-gw.myshopify.com",
SHOPIFY_STOREFRONT_ACCESS_TOKEN:
process.env.SHOPIFY_STOREFRONT_ACCESS_TOKEN ||
"2503dfbf93132b42e627e7d53b3ba3e9",
process.env.SHOPIFY_STOREFRONT_ACCESS_TOKEN,
hooks: {
onBrokenMarkdownLinks: "warn",
},
Expand Down
17 changes: 1 addition & 16 deletions src/lib/statsProvider.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ import React, {
type ReactNode,
} from "react";
import { githubService, type GitHubOrgStats } from "../services/githubService";
import useDocusaurusContext from "@docusaurus/useDocusaurusContext";

// Time filter types
export type TimeFilter = "week" | "month" | "year" | "all";
Expand Down Expand Up @@ -160,11 +159,6 @@ const isPRInTimeRange = (mergedAt: string, filter: TimeFilter): boolean => {
export function CommunityStatsProvider({
children,
}: CommunityStatsProviderProps) {
const {
siteConfig: { customFields },
} = useDocusaurusContext();
const token = customFields?.gitToken || "";

const [loading, setLoading] = useState(false); // Start with false to avoid hourglass
const [error, setError] = useState<string | null>(null);
const [githubStarCount, setGithubStarCount] = useState(984); // Placeholder value - updated to match production
Expand Down Expand Up @@ -433,17 +427,8 @@ export function CommunityStatsProvider({

setError(null);

if (!token) {
setError(
"GitHub token not found. Please set customFields.gitToken in docusaurus.config.js.",
);
setLoading(false);
return;
}

try {
const headers: Record<string, string> = {
Authorization: `token ${token}`,
Accept: "application/vnd.github.v3+json",
};

Expand Down Expand Up @@ -497,7 +482,7 @@ export function CommunityStatsProvider({
setLoading(false);
}
},
[token, fetchAllOrgRepos, processBatch, cache],
[fetchAllOrgRepos, processBatch, cache],
);

const clearCache = useCallback(() => {
Expand Down
10 changes: 1 addition & 9 deletions src/services/githubService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,18 +70,10 @@ class GitHubService {

// Get headers for GitHub API requests
private getHeaders(): Record<string, string> {
const headers: Record<string, string> = {
return {
Accept: "application/vnd.github.v3+json",
"Content-Type": "application/json",
};

// Add GitHub token if available in environment
// Note: In production, you might want to use a server-side proxy to avoid exposing tokens
if (typeof window !== "undefined" && (window as any).GITHUB_TOKEN) {
headers["Authorization"] = `token ${(window as any).GITHUB_TOKEN}`;
}

return headers;
}
Comment on lines 71 to 77
Copy link

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The getHeaders() change removes Authorization, but this service makes requests to https://api.github.com/graphql (e.g., discussions count / discussions list). GitHub’s GraphQL API requires authentication, so these calls will now consistently fail (401) and the code will fall back to 0 discussions / mock discussions. Consider moving GraphQL calls behind a server-side endpoint (preferred), or switch to unauthenticated REST endpoints, or gate/disable these GraphQL features when no server-side auth is available.

Copilot uses AI. Check for mistakes.

// === ADDED: setter to toggle anonymous contributors inclusion
Expand Down
19 changes: 2 additions & 17 deletions wiki/Documentation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -573,7 +573,7 @@ Response Example:
}
```
#### Authentication
All requests require a GitHub Personal Access Token:
Authenticated requests should be made from a server-side endpoint or serverless function so the token is never shipped to the browser:
```typescript
const headers: Record<string, string> = {
Authorization: `token ${YOUR_GITHUB_TOKEN}`,
Expand All @@ -588,22 +588,7 @@ Select scopes: public_repo, read:org
Copy the token (you won't see it again!)

#### Storing the Token:
In Docusaurus, we store it in docusaurus.config.js:
```javascript
module.exports = {
customFields: {
gitToken: process.env.GITHUB_TOKEN || '',
},
// ...
};
```
Then access it:
```typescript
const {
siteConfig: { customFields },
} = useDocusaurusContext();
const token = customFields?.gitToken || "";
```
Do not store a GitHub token in `docusaurus.config.js` or any other client-bundled config. Keep it in server-side environment variables and call GitHub from a backend endpoint instead.
#### Error Handling
**Rate Limit Exceeded (403)**

Expand Down
Loading