publicStripeKey: "" crash in env.js for self-hosted instances.
Stale
# Self-hosted dashboard blank screen — Stripe.js crashes on empty `publicStripeKey`
## Description
The Nango dashboard renders a completely blank/black screen on self-hosted instances. The root cause is `stripe.js` attempting to initialize with an empty string, which throws an unhandled error that kills the entire React app.
## Console Error
```
Uncaught (in promise) IntegrationError: Please call Stripe() with your publishable key. You used an empty string.
at stripe.js:1
```
Additionally:
```
The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
at stripe.js:1
```
## Root Cause
The `/env.js` endpoint returns `"publicStripeKey": ""` for self-hosted instances (expected, since self-hosted doesn't use Stripe billing). However, the dashboard frontend code calls `Stripe("")` unconditionally without checking whether the key is a non-empty string first.
**`/env.js` output:**
```json
window._env = {
"apiUrl": "https://nango.example.com",
"publicStripeKey": "",
"isCloud": false,
"isHosted": true,
"isEnterprise": false,
"features": {
"plan": false
}
}
```
Despite `isCloud: false` and `features.plan: false`, the Stripe initialization still runs and crashes.
## Environment
- **Image:** `nangohq/nango-server:hosted` (also reproduced on `hosted-0.69.30`)
- **Version:** 0.69.40+ (git hash `5fc90c54d6b4efc23bddd6652fbbc087621ebd8d`)
- **Deployment:** Docker Compose via Coolify on Ubuntu 24
- **Self-hosted:** Yes, free tier
## Steps to Reproduce
1. Deploy `nangohq/nango-server:hosted` with standard self-hosted configuration per [[docs](https://nango.dev/docs/guides/platform/free-self-hosting/configuration)](https://nango.dev/docs/guides/platform/free-self-hosting/configuration)
2. Navigate to the dashboard URL in a browser
3. Observe blank/black screen
4. Open browser DevTools → Console → see `IntegrationError` from `stripe.js`
## Expected Behavior
The dashboard should load normally on self-hosted instances. Stripe initialization should be gated behind a check like:
```javascript
if (window._env.publicStripeKey && window._env.isCloud) {
loadStripe(window._env.publicStripeKey);
}
```
## Workaround
The API itself is unaffected — `/health` returns `{"result":"ok"}` and all OAuth/proxy/connection endpoints work normally. The issue is isolated to the dashboard UI. Integrations can be managed via the API or `@nangohq/node` SDK as a workaround.
## Impact
This completely blocks dashboard access for all self-hosted users on the current `:hosted` tag. No configuration changes or documented environment variables resolve the issue.
关闭于 2026-05-02 4 条评论