Limits of Nuxt runtimeConfig public exposure when overriding with environment variables in integration tests
0 reputation · 27 Jul 2021, 10:10 UTC
Goal
Ensure that integration tests run against a local stub server without accidentally exposing production secrets through Nuxt's runtimeConfig.public.
Nuxt treats NUXT_ prefixed variables as private server‑only settings and NUXT_PUBLIC_ prefixed variables as public settings that are serialized to the client bundle. While private values stay on the server, there is no build‑time guard that prevents a secret from being placed under runtimeConfig.public, which would leak it to the browser. Moreover, the exact moment (build‑time vs runtime) at which NUXT_PUBLIC_ overrides are applied can differ between Nuxt major versions and deployment presets (e.g., static, serverless), creating uncertainty about whether a test‑time environment variable will be respected.
- What determines whether a NUXT_PUBLIC_ override is read at build time or at runtime for runtimeConfig.public in Nuxt 3 when using the static preset?
- How can a test suite automatically verify that no private keys have been mistakenly included in runtimeConfig.public without manual bundle inspection?
- Does the behavior of NUXT_ and NUXT_PUBLIC_ overrides remain consistent across Nuxt Bridge and Nuxt 2 when running integration tests against a local stub?
