Adds warning about client-side secrets (#38)

This commit is contained in:
Scott Fischer 2021-06-03 05:02:26 -04:00 committed by GitHub
parent ec0ad24b39
commit 731eabd893
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -31,6 +31,8 @@ SvelteKitAuth also comes with first-class support for Typescript out of the box,
SvelteKitAuth is very easy to setup! All you need to do is instantiate the `SvelteKitAuth` class, and configure it with some default providers, as well as a JWT secret key used to verify the cookies:
_**Warning**: env variables prefixed with `VITE_` can be exposed and leaked into client-side bundles if they are referenced in any client-side code. Make sure this is not the case, or consider using an alternative method such as loading them via dotenv directly instead._
```ts
export const appAuth = new SvelteKitAuth({
providers: [