Q48: How do Server Components enforce security boundaries for private API keys?
Because Server Components run strictly on the server and are never bundled or sent to client browsers, private environment secrets (database credentials, private API keys) accessed inside Server Components cannot leak to client bundles.
Enforcing Server-Only Code Boundaries
// lib/secretService.js
import 'server-only'; // Throws build error if imported into Client Component
export async function getPrivateData() {
const key = process.env.VERY_PRIVATE_API_KEY;
return await fetch('https://api.internal', { headers: { Authorization: key } });
}💡 import 'server-only' raises build-time errors if secret code gets referenced by client bundles.
Key Takeaways
- Server secrets stay isolated on Node.js/Edge server environments.
- Importing
import 'server-only'throws build errors if code accidentally leaks to client modules.
Knowledge Check
What is the purpose of the 'server-only' npm package in React Server Component architectures?