
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
next-feature-flags
Advanced tools
A package to enable feature-flag support on Next.js via cookies and environment variables
Add support for feature flags on Next.js based on cookies + environment variables.
It reads from cookies and Next.js's runtime config and provides an interface to enable and disable feature flags.
An interface to toggle feature flags on the browser is also provided via window.FEATURES.
It prioritizes feature flags from cookies over Next.js runtime config, meaning that if the same feature flag is set on both sides, the cookie one prevails.
import { configure } from 'next-feature-flags';
configure({
featureFlags: ['SHOW_LOGIN_BANNER', 'USER_ESCALATE_PRIVILEGES'],
allowCookieOverride: ['SHOW_LOGIN_BANNER']
})
featureFlags - lists the feature flags available
allowCookieOverride - lists the features flags which can be overriden by setting a cookie. This enables for some safety and not letting users override critical feature flags
import { configure } from 'next-feature-flags';
const { getFeatureFlag } = configure({
featureFlags: ['SHOW_LOGIN_BANNER', 'USER_ESCALATE_PRIVILEGES'],
allowCookieOverride: ['SHOW_LOGIN_BANNER']
})
const shouldShowLoginBanner = () => getFeatureFlag('SHOW_LOGIN_BANNER')
Note: next-feature-flags uses the FEATURE key both to write/read from cookies and from the environment, meaning the if you send SHOW_LOGIN_BANNER next-feature-flags will try to read from FEATURE_SHOW_LOGIN_BANNER and will read/write from that same cookie.
Possible improvement: customize this key.
To override feature flags on the client, use the window.FEATURES interface.
On the console:
> window.FEATURES
> {SHOW_LOGIN_BANNER: {enable: fn, disable: fn}}
> window.FEATURES.SHOW_LOGIN_BANNER.enable()
> 'FEATURES_SHOW_LOGIN_BANNER=true'
Using this interface will set the cookie value (FEATURES_SHOW_LOGIN_BANNER), if you're using the feature flags on the server side (like getServerSideProps) make sure you reload your browser.
Whenever you want to turn it off, you can use the disable method the same way.
next-feature-flags gets environment variables from Next.js runtime config (https://nextjs.org/docs/api-reference/next.config.js/runtime-configuration).
To expose these variables there (and make them available both on the client and server side), use them the following way:
// next.config.js
module.exports = {
serverRuntimeConfig: {
SHOW_LOGIN_BANNER: process.env.FEATURE_SHOW_LOGIN_BANNER, // Pass through env variables
},
publicRuntimeConfig: {
SHOW_LOGIN_BANNER: process.env.NEXT_PUBLIC_FEATURE_SHOW_LOGIN_BANNER
},
}
By having the variables with the same name (even though one is getting from the public namespace and the other not) makes it possible for next-feature-flags to get them. It will prioritize the value in serverRuntimeConfig over publicRuntimeConfig.
FAQs
A package to enable feature-flag support on Next.js via cookies and environment variables
We found that next-feature-flags demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.