06. Server-Only Packages (import "server-only") & Taint API for Secret Protection • Next.js 14+ App Router & Full-Stack Architecture • Rishabh Ki Kaksha

Agar koi junior developer aisi utility file ko Client Component me import kar le jisme `process.env.STRIPE_SECRET_KEY` ya Database credentials hon — **saare private keys user ke browser me leak ho jayenge!**

---

### 2. `import 'server-only'` (Build-Time Safety Lock 🔒)

Agar koi file sirf server par chalni chahiye:

```typescript
// lib/payments.ts
import "server-only"; // 👑 BUILD-TIME FIREWALL!

export async function processStripeRefund(paymentId: string) {
    const secretKey = process.env.STRIPE_SECRET_KEY;
    // ...
}
```
*Agar kisi ne is file ko `"use client"` component me import kiya, toh **Next.js build instant fail ho jayega!***

---

### 3. Experimental Taint API (`experimental_taintObjectReference`)

Sensitive user objects (jaise Credit Card details, Password hashes) ko Client Components me pass hone se rokna:

```typescript
import { experimental_taintObjectReference } from "react";

export async function getUserData(userId: string) {
    const user = await db.users.findUnique({ where: { id: userId } });

// 🛡️ Taint the sensitive credentials object:
    experimental_taintObjectReference(
        "Do NOT pass user password hash or 2FA secret to the client!",
        user.securityDetails
    );

return user;
}
```

---

### 4. Master Comparison Matrix

---

### 5. Interview Ke 3 Sawal Is Topic Se

1. **`process.env.API_KEY` vs `process.env.NEXT_PUBLIC_API_KEY` me kya fark hai?** -> `NEXT_PUBLIC_` prefixed variables build time par client JS bundle me inlined ho jaate hain aur browser me visible hote hain; bina prefix wale variables sirf Server par accessible hote hain.
2. **`import 'client-only'` package ka kya use case hai?** -> Aisi libraries ko protect karna jo purely browser APIs (`window`, `localStorage`, Canvas) par depend karti hain taaki wo galti se Server Component me execute na hon.
3. **Taint Unique Value (`experimental_taintUniqueValue`) kya karta hai?** -> Ye individual primitive values (jaise user ka Personal Access Token ya Aadhaar String) ko props me leak hone se block karta hai.

---
**Next Topic:** 07. Dynamic Segments, Catch-All ([...slug]) & Optional Catch-All ([[...slug]])

Loading lesson content...

JavaScript

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track