Example in README.md

[satoutanaka]

Thank you for creating great project.

In this example, getServerSideProps returns secret data only login user .
getFirebaseAdmin() => FirebaseAdmin

But, If you redirect to login page, you can see secret data in __NEXT_DATA__ by using Chrome developer tools.

You can avoid this problem by using withAuthUserTokenSSR.

What are your thoughts on that?

[kmjennison]

I'm not sure I understand your question. It's expected that server-side props are available in the DOM (e.g., see vercel/next.js#15117). The same would be true of any props added with withAuthUserTokenSSR.

[satoutanaka]

I really apprecaite your reply.
There is secret data in __NEXT_DATA__ of redirect page.
What I mean is not logged in user can see secret data by using using Chrome developer tools in this case.
In withAuthUserTokenSSR, getServerSidePropsFunc run after REDIRECT_TO_APP. So there is not secret data in __NEXT_DATA__ of login page.

[kmjennison]

I got it, thanks for explaining! I removed the whenUnauthedAfterInit property from the example, so we can assume the example is using non-sensitive, public data. Of course, developers have to decide what makes sense for their apps.

Keep in mind that any time you server-render with authed data from the cookies, that data will be available to the client even if the user is not authenticated with Firebase on the client side. This is not a big deal in most cases, because the user's token from the cookies will still have to be valid.

[satoutanaka]

I appreciate your cooperation and advice