fix: stop exposing client-side tokens by Abhash-Chakraborty · Pull Request #1329 · recodehive/recode-website

Abhash-Chakraborty · 2026-04-15T05:37:39Z

Summary

remove the GitHub token from Docusaurus client config and stop sending authenticated GitHub requests from browser code
remove the hardcoded Shopify storefront token fallback from site config
update the internal documentation to clarify that exposing these values in client-bundled config was a mistake, not an intended design

Testing

npm run build
npm run typecheck (currently fails on unrelated pre-existing TypeScript errors elsewhere in the repo)

vercel · 2026-04-15T05:37:46Z

@Abhash-Chakraborty is attempting to deploy a commit to the recode Team on Vercel.

A member of the Team first needs to authorize it.

github-actions · 2026-04-15T05:37:50Z

Thank you for submitting your pull request! 🙌 We'll review it as soon as possible. The estimated time for response is 5–8 hrs.

In the meantime, please provide all necessary screenshots and make sure you run - npm build run , command and provide a screenshot, a video recording, or an image of the update you made below, which helps speed up the review and assignment. If you have questions, reach out to LinkedIn. Your contributions are highly appreciated!😊

Note: I maintain the repo issue every day twice at 8:00 AM IST and 9:00 PM IST. If your PR goes stale for more than one day, you can tag and comment on this same issue by tagging @sanjay-kv.

We are here to help you on this journey of open source. Consistent 20 contributions are eligible for sponsorship 💰

🎁 check our list of amazing people we sponsored so far: GitHub Sponsorship. ✨

📚Your perks for contribution to this community 👇🏻

Get free Consultation use code recode50 to get free: Mentorship for free.
Get the Ebook for free use code recode at checkout: Data Science cheatsheet for Beginners.
Check out this weekly Newsletter: Sanjay's Newsletter.

If there are any specific instructions or feedback regarding your PR, we'll provide them here. Thanks again for your contribution! 😊

Abhash-Chakraborty · 2026-04-16T16:52:28Z

@sanjay-kv Can you please review this?

vercel · 2026-04-18T09:38:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
recode-website	Ready	Preview, Comment	Apr 30, 2026 7:02am

Copilot

Pull request overview

This PR removes previously client-exposed secrets from the Docusaurus site configuration and updates docs/code to avoid making authenticated GitHub requests from browser-bundled code.

Changes:

Remove GitHub token plumbing from client config and client-side request headers.
Remove hardcoded Shopify Storefront token fallback from the Docusaurus config.
Update internal documentation to clarify tokens must remain server-side.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
wiki/Documentation.md	Updates guidance to avoid storing GitHub tokens in client-bundled Docusaurus config.
src/services/githubService.ts	Removes browser token injection from GitHub request headers.
src/lib/statsProvider.tsx	Stops reading GitHub token from Docusaurus context and removes Authorization header usage.
docusaurus.config.ts	Removes GitHub token exposure and deletes hardcoded Shopify token fallback.

Comments suppressed due to low confidence (1)

wiki/Documentation.md:581

The TypeScript code fence opened for the headers example isn’t closed before the next markdown heading (#### Getting a Token:), which will cause the rest of this section to render as code. Add a closing ``` after the headers example.

Authenticated requests should be made from a server-side endpoint or serverless function so the token is never shipped to the browser:
```typescript
const headers: Record<string, string> = {
  Authorization: `token ${YOUR_GITHUB_TOKEN}`,
  Accept: "application/vnd.github.v3+json",
};

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-18T09:40:38Z

  // Get headers for GitHub API requests
  private getHeaders(): Record<string, string> {
-    const headers: Record<string, string> = {
+    return {
      Accept: "application/vnd.github.v3+json",
      "Content-Type": "application/json",
    };
-
-    // Add GitHub token if available in environment
-    // Note: In production, you might want to use a server-side proxy to avoid exposing tokens
-    if (typeof window !== "undefined" && (window as any).GITHUB_TOKEN) {
-      headers["Authorization"] = `token ${(window as any).GITHUB_TOKEN}`;
-    }
-
-    return headers;
  }


The getHeaders() change removes Authorization, but this service makes requests to https://api.github.com/graphql (e.g., discussions count / discussions list). GitHub’s GraphQL API requires authentication, so these calls will now consistently fail (401) and the code will fall back to 0 discussions / mock discussions. Consider moving GraphQL calls behind a server-side endpoint (preferred), or switch to unauthenticated REST endpoints, or gate/disable these GraphQL features when no server-side auth is available.

@Abhash-Chakraborty look into this

sanjay-kv · 2026-04-19T22:39:18Z

@Adez017 could you check this?

Adez017 · 2026-04-20T02:58:48Z

@Adez017 could you check this?

Sure I'll look into this

Adez017 · 2026-04-22T06:28:17Z

Hi @Abhash-Chakraborty ,good fix on the intent — tokens absolutely should not be in customFields. But before this merges, please:

Handle the GitHub GraphQL calls — they'll return 401s now. Either proxy them through a serverless function or replace with unauthenticated REST endpoints.
Verify docusaurus.config.ts compiles correctly and hooks is not accidentally nested inside customFields.
Fix the unclosed code fence in Documentation.md.
Rotate the Shopify Storefront token that was hardcoded — it's still in git history.

CC: @sanjay-kv

Adez017 · 2026-04-22T06:22:21Z

  // Get headers for GitHub API requests
  private getHeaders(): Record<string, string> {
-    const headers: Record<string, string> = {
+    return {
      Accept: "application/vnd.github.v3+json",
      "Content-Type": "application/json",
    };
-
-    // Add GitHub token if available in environment
-    // Note: In production, you might want to use a server-side proxy to avoid exposing tokens
-    if (typeof window !== "undefined" && (window as any).GITHUB_TOKEN) {
-      headers["Authorization"] = `token ${(window as any).GITHUB_TOKEN}`;
-    }
-
-    return headers;
  }


@Abhash-Chakraborty look into this

Abhash-Chakraborty · 2026-04-22T07:52:01Z

@Adez017 Check now

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

wiki/Documentation.md:588

The ```typescript code block started here isn’t closed before the next heading (#### Getting a Token:). This will cause the rest of the document to render as code in Markdown. Add a closing triple-backtick after the headers example (after the };).

Authenticated requests should be made from a server-side endpoint or serverless function so the token is never shipped to the browser:
```typescript
const headers: Record<string, string> = {
  Authorization: `token ${YOUR_GITHUB_TOKEN}`,
  Accept: "application/vnd.github.v3+json",
};

#### Getting a Token:

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-23T11:29:42Z

+  // GitHub GraphQL requires authentication, so the browser should not call it directly.
  private async getDiscussionsCount(
    signal?: AbortSignal,
    repoName: string = "Support",
  ): Promise<number> {
+    if (!this.canUseGitHubGraphQL()) {
+      return 0;
+    }


getDiscussionsCount() returns 0 when GraphQL is unavailable in the browser. That makes downstream UI/reporting treat the value as a real count ("0 discussions") rather than "unavailable", which is misleading. Consider representing this as null/undefined (and updating GitHubOrgStats + UI), or surfacing an explicit "unavailable" flag/message instead of overloading 0.

@Abhash-Chakraborty this can be doable

Copilot · 2026-04-23T11:29:43Z

+    if (!this.canUseGitHubGraphQL()) {
+      throw new Error(this.DISCUSSIONS_UNAVAILABLE_MESSAGE);
+    }
+


Even when canUseGitHubGraphQL() is true, fetchDiscussions() still calls https://api.github.com/graphql directly without any auth header. If/when this is invoked in a server-side context, it will still fail with 401 unless you route through an authenticated proxy or add server-side auth (e.g., from env). Consider failing fast with a clear configuration error when no server-side token/proxy is available, rather than attempting the call.

@copilot apply changes based on this feedback

@Abhash-Chakraborty

Adez017 · 2026-04-23T12:27:44Z

@copilot apply changes based on the comments in this thread

Adez017 · 2026-04-24T04:57:00Z

Hi @Abhash-Chakraborty , i had made a look onto this one . there are some bugs still needs to be fixed . i would request you to look into this and try to resolve .

CC: @sanjay-kv

Abhash-Chakraborty · 2026-04-28T08:57:52Z

@Adez017 Yes, this now covers the discussions flow as well, and they remain dynamic in prod.
I updated the implementation so the browser no longer talks to GitHub GraphQL directly and no token is exposed through Docusaurus config/customFields anymore. Instead, the dashboard now fetches discussions from a server-side /api/github-discussions endpoint, which uses the token only on the server and returns sanitized discussion data to the client.
So behavior-wise:

discussions still work dynamically in production
the refresh action still fetches live data
no client-side GitHub token exposure is needed anymore

For compatibility, I also kept support for the existing DOCUSAURUS_GIT_TOKEN env as a legacy fallback, so current prod should continue working without needing an immediate env rename. GITHUB_TOKEN is now the preferred variable going forward.

Adez017

@sanjay-kv , can you test the changes in vercel preview ? also try to validate everything .

Abhash-Chakraborty · 2026-04-28T09:02:50Z

@sanjay-kv Please update variables pre-deployment.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-29T00:56:02Z

+      const [, repositories] = await Promise.all([
        this.fetchOrganizationInfo(signal),
        this.fetchAllRepositories(signal),
      ]);


fetchOrganizationStats() still performs fetchOrganizationInfo() (the first Promise in the Promise.all), but the result is intentionally ignored. This adds an extra GitHub API request on every refresh/cache miss, increasing latency and rate-limit risk. Consider removing the org-info call entirely (or using its data in the computed stats) so you only request what you need.

Suggested change

const [, repositories] = await Promise.all([

this.fetchOrganizationInfo(signal),

this.fetchAllRepositories(signal),

]);

const repositories = await this.fetchAllRepositories(signal);

@Abhash-Chakraborty

Copilot · 2026-04-29T00:56:03Z

+    const payload = (await response.json()) as GitHubDiscussionsResponse;

-      const data = await response.json();
+    if (!response.ok) {
+      throw new Error(payload.message || "Failed to fetch GitHub discussions.");
+    }


fetchDiscussions() unconditionally calls response.json() before checking response.ok. If the /api/github-discussions route is missing/misconfigured (404 HTML) or returns a non-JSON error body, this will throw a JSON parse error and lose the real HTTP status/context. Consider parsing defensively (e.g., read text first, or only JSON-parse when the Content-Type is JSON) and include the status code in the thrown error when available.

Copilot · 2026-04-29T00:56:03Z

+export default async function handler(req, res) {
+  const token = getToken();


This new API handler uses ESM syntax (export default) in a .js file, but package.json does not declare "type": "module". In a standard Node.js/CommonJS runtime this will fail to load with a syntax error. Consider switching this to CommonJS exports (module.exports = handler) or renaming to .mjs / configuring the project/runtime to treat api/* as ESM consistently.

Check out this one too.

Copilot · 2026-04-29T00:56:03Z

+  res.setHeader(
+    "Cache-Control",
+    "public, s-maxage=300, stale-while-revalidate=600",
+  );


Cache-Control is set before checking whether a token is configured and before the GitHub fetch succeeds. As written, 503 (no token) and 502 (upstream failure) responses will also be cached by CDNs for 5 minutes (s-maxage=300), potentially prolonging outages after configuration fixes. Consider only setting long-lived caching on successful (200) responses, and using a much shorter TTL or no-store for error responses.

Copilot · 2026-04-29T00:56:03Z

 Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
 Generate new token
 Select scopes: public_repo, read:org
 Copy the token (you won't see it again!)


The “Select scopes” guidance here omits read:discussion, but .env.example now recommends public_repo, read:org, read:discussion for the token used by /api/github-discussions. Please align these docs so users generate a token with the scopes actually required for the GraphQL discussions query.

Adez017 · 2026-04-29T06:10:52Z

@Abhash-Chakraborty , some of the suggestion from copilot are need to be take care . try to resolve them.

Adez017 · 2026-04-30T04:26:36Z

@Abhash-Chakraborty any updates on this ?
CC: @sanjay-kv

# Conflicts: # docusaurus.config.ts

Abhash-Chakraborty · 2026-04-30T05:19:15Z

@Adez017

Adez017 · 2026-04-30T05:23:01Z

@Abhash-Chakraborty , try to fix the CI issues

Abhash-Chakraborty · 2026-04-30T05:25:20Z

@Adez017 It's not failing because of my changes. I think you should re-run the CI.

Adez017 · 2026-04-30T05:29:48Z

@sanjay-kv could you trigger the vercel and verify the the changes been correctly done without any bugs or outage . ?

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-30T06:53:16Z

        const headers: Record<string, string> = {
-          Authorization: `token ${token}`,
          Accept: "application/vnd.github.v3+json",
        };

        // Fetch both org stats and repos in parallel
-        const [orgStats, repos] = await Promise.all([
+        const [orgStats, repos, discussionsCount] = await Promise.all([
          githubService.fetchOrganizationStats(signal),
          fetchAllOrgRepos(headers),
+          githubService.fetchDiscussionsCount(signal),
        ]);


fetchAllStats() now performs a large number of unauthenticated GitHub REST calls (listing repos + up to 10 pages of PRs per repo). With GitHub’s low unauthenticated rate limit, this is likely to hit 403s quickly and break the dashboard/leaderboard for users. Consider moving these GitHub calls behind a server-side proxy (similar to /api/github-discussions) and/or drastically reducing the number of client-side requests (e.g., fewer repos/pages, server-side caching).

Copilot · 2026-04-30T06:53:16Z

    try {
-      // Fetch organization info and repositories in parallel
-      const [orgInfo, repositories] = await Promise.all([
-        this.fetchOrganizationInfo(signal),
-        this.fetchAllRepositories(signal),
-      ]);
+      const repositories = await this.fetchAllRepositories(signal);



After removing the fetchOrganizationInfo() call from fetchOrganizationStats(), the private fetchOrganizationInfo() helper is now unused in this class. Consider deleting it to avoid dead code and keep the service focused on the endpoints it actually uses.

Co-authored-by: Copilot <[email protected]>

sanjay-kv · 2026-04-30T07:14:25Z

@Adez017 @sachinggsingh can you check this
in the preview it was working fine, not sure to change any env file in Vercel.

Adez017 · 2026-04-30T08:03:11Z

@sanjay-kv working fine in prod :

sanjay-kv · 2026-04-30T08:29:48Z

@Adez017 i reverted the change thats why

sachinggsingh · 2026-04-30T08:52:54Z

@Adez017 @sachinggsingh can you check this in the preview it was working fine, not sure to change any env file in Vercel.

I will look into it

fix: stop exposing client-side tokens

a2b6a8c

github-actions Bot added the recode this is label for leaderboard label Apr 15, 2026

sanjay-kv approved these changes Apr 18, 2026

View reviewed changes

sanjay-kv requested review from Adez017 and Copilot April 18, 2026 09:37

sanjay-kv assigned Abhash-Chakraborty Apr 18, 2026

sanjay-kv added this to @recode-web Apr 18, 2026

sanjay-kv added this to the recode:launch 3.0 milestone Apr 18, 2026

sanjay-kv moved this to In Progress in @recode-web Apr 18, 2026

Copilot started reviewing on behalf of sanjay-kv April 18, 2026 09:38 View session

vercel Bot deployed to Preview April 18, 2026 09:39 View deployment

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Adez017 requested changes Apr 22, 2026

View reviewed changes

fix: gate client-side GitHub discussions

8f47c28

Adez017 requested a review from Copilot April 23, 2026 11:23

Copilot started reviewing on behalf of Adez017 April 23, 2026 11:24 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

Abhash-Chakraborty added 2 commits April 24, 2026 18:17

fix(github): handle unavailable discussions stats

fb43872

Merge upstream main into Abhash/Changes

0190eea

sanjay-kv added the level 3 50 points label Apr 26, 2026

Adez017 reviewed Apr 28, 2026

View reviewed changes

sanjay-kv approved these changes Apr 28, 2026

View reviewed changes

vercel Bot deployed to Preview April 28, 2026 09:13 View deployment

sanjay-kv requested a review from Copilot April 29, 2026 00:49

Copilot started reviewing on behalf of sanjay-kv April 29, 2026 00:49 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

Abhash-Chakraborty added 2 commits April 30, 2026 10:35

fix(github): address discussions proxy review

68e12b8

Merge remote-tracking branch 'upstream/main' into Abhash/Changes

39de21a

# Conflicts: # docusaurus.config.ts

Adez017 approved these changes Apr 30, 2026

View reviewed changes

vercel Bot deployed to Preview April 30, 2026 06:46 View deployment

sanjay-kv requested a review from Copilot April 30, 2026 06:47

Copilot started reviewing on behalf of sanjay-kv April 30, 2026 06:48 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

Update wiki/Documentation.md

07f6eda

Co-authored-by: Copilot <[email protected]>

vercel Bot deployed to Preview April 30, 2026 07:02 View deployment

sanjay-kv merged commit d5706f4 into recodehive:main Apr 30, 2026
6 checks passed

github-project-automation Bot moved this from In Progress to Done in @recode-web Apr 30, 2026

sanjay-kv mentioned this pull request Apr 30, 2026

Revert "fix: stop exposing client-side tokens" #1364

Merged

		export default async function handler(req, res) {
		const token = getToken();

Conversation

Abhash-Chakraborty commented Apr 15, 2026

Summary

Testing

Uh oh!

vercel Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Abhash-Chakraborty commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

sanjay-kv commented Apr 19, 2026

Uh oh!

Adez017 commented Apr 20, 2026

Uh oh!

Adez017 commented Apr 22, 2026

Uh oh!

Adez017 Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Abhash-Chakraborty commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 commented Apr 23, 2026

Uh oh!

Adez017 commented Apr 24, 2026

Uh oh!

Abhash-Chakraborty commented Apr 28, 2026

Uh oh!

Adez017 left a comment

Choose a reason for hiding this comment

Uh oh!

Abhash-Chakraborty commented Apr 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Adez017 Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Abhash-Chakraborty commented Apr 16, 2026 •

edited

Loading

vercel Bot commented Apr 18, 2026 •

edited

Loading