The "frontend-token-secret" secret is not available to the production build when it's needed #44

New issue

Closed

opened 2026-04-22 07:37:46 +00:00 by andkaha · 1 comment

andkaha commented

2026-04-22 07:37:46 +00:00

(Migrated from github.com)

Describe the bug

The frontend-token-secret secret is required when the pages are rendered, and they are rendered during the build step. In production, the build step happens before run time, which means that the container does not have the secret file available yet, as it is mounted at run time (-->fails). In development, the build happens during run time, so the secret is available (-->succeeds).

This means that the code on the develop branch currently can not be built for production.

$ ./compose-prod.sh build

[...]

9.073   Collecting page data using 4 workers ...
9.456   Generating static pages using 4 workers (0/3) ...
9.879 Error occurred prerendering page "/". Read more: https://nextjs.org/docs/messages/prerender-error
9.883 Error: No session token secret path defined.
9.883     at a_ (.next/server/chunks/ssr/[root-of-the-server]__0iuvlsd._.js:5:38496)
9.883     at a1 (.next/server/chunks/ssr/[root-of-the-server]__0iuvlsd._.js:5:38919)
9.883     at e (.next/server/chunks/ssr/[root-of-the-server]__0ugj8oc._.js:1:1200)
9.883     at stringify (<anonymous>) {
9.883   digest: '1083154860'
9.883 }
9.883 Export encountered an error on /page: /, exiting the build.
9.901 ⨯ Next.js build worker exited with code: 1 and signal: null

It is possible that the SESSION_TOKEN_SECRET_PATH variable should be passed to the build step via a build argument and then made into an environment variable in the Dockerfile, but also means the secret itself probably needs to be copied into the container (or be made available via a temporary bind mount), which seems odd. The use of the variable should be reevaluated and its implementation fixed.

## Describe the bug The `frontend-token-secret` secret is required when the pages are rendered, and they are rendered during the build step. In production, the build step happens before run time, which means that the container does not have the secret file available yet, as it is mounted at run time (-->fails). In development, the build happens during run time, so the secret is available (-->succeeds). This means that the code on the `develop` branch currently can not be built for production. ``` $ ./compose-prod.sh build [...] 9.073 Collecting page data using 4 workers ... 9.456 Generating static pages using 4 workers (0/3) ... 9.879 Error occurred prerendering page "/". Read more: https://nextjs.org/docs/messages/prerender-error 9.883 Error: No session token secret path defined. 9.883 at a_ (.next/server/chunks/ssr/[root-of-the-server]__0iuvlsd._.js:5:38496) 9.883 at a1 (.next/server/chunks/ssr/[root-of-the-server]__0iuvlsd._.js:5:38919) 9.883 at e (.next/server/chunks/ssr/[root-of-the-server]__0ugj8oc._.js:1:1200) 9.883 at stringify (<anonymous>) { 9.883 digest: '1083154860' 9.883 } 9.883 Export encountered an error on /page: /, exiting the build. 9.901 ⨯ Next.js build worker exited with code: 1 and signal: null ``` It is possible that the `SESSION_TOKEN_SECRET_PATH` variable should be passed to the build step via a build argument and then made into an environment variable in the Dockerfile, but also means the secret itself probably needs to be copied into the container (or be made available via a temporary bind mount), which seems odd. The use of the variable should be reevaluated and its implementation fixed.

pdmnyberg commented

2026-04-24 15:12:33 +00:00

(Migrated from github.com)

I have investigated this and I think I know what the problem is here.

The problem is that pages which use the session should generally note be prebuilt in this way. The prebuild step tries to use the session which does not currently exist. I have identified what I think is the solution: https://nextjs.org/docs/app/api-reference/functions/connection

I will provide a fix for this.

I have investigated this and I think I know what the problem is here. The problem is that pages which use the session should generally note be prebuilt in this way. The prebuild step tries to use the session which does not currently exist. I have identified what I think is the solution: https://nextjs.org/docs/app/api-reference/functions/connection I will provide a fix for this.