Expose env vars both with and without the REACT_APP_ prefix

[andreas-karlsson]

Is your proposal related to a problem?

A third party library I'm using leverages a certain env variable, say XYZ. Currently there's no way for me to supply that.

Describe the solution you'd like

I realize it's a good safety measure for CRA to only pick up env vars with the prefix, and I don't object to that. However CRA could populate process.env with both keys i.e. both REACT_APP_XYZ and XYZ. That wouldn't violate the safety in any way, but still allows for code to expect any named env var.

[Seqi]

This will drag all your environment variables from your build servers into your bundles. These could contain sensitive data.

[andreas-karlsson]

@Seqi No. Why would it do that? That's what I'm explicitly stating in the issue. CRA should only "drag in" variables with the prefix, but then it could populate the process.env object with two properties for each prefixed env. One with, and one without the prefix.

[Seqi]

@andreas-karlsson Ah sorry I misread.

[Exifers]

How about a way to whitelist some environment variables names in a config ?

This would not limit env vars to the ones starting with REACT_APP_ and be as safe as currently.