Using Environment Variable in Django to avoid security compromise

 While working with web applications often we need to store sensitive data for authentication of different modules such as database credentials and API keys. These sensitive keys should not be hardcoded in the settings.py file instead they should be loaded with Environment variables on runtime.

An environment variable is a variable whose value is set outside the program, typically through a functionality built into the operating system. An environment variable is made up of a name/value pair.

Environment variables help us keep secrets (for example, Passwords, API tokens, and so on) out of version control, therefore, they are considered an integral part of the popular Twelve-Factor App Design methodology and a Django best practice because they allow a greater level of security and simpler local/production configurations.

Also, environment variables provide a greater degree of flexibility for switching between local development setup and production setup.

Therefore Adding environment variables is a necessary step for any truly professional Django project.

Creating Environment Variables

Create a .env file in the same directory where settings.py resides and add the following key-value pair inside the file.

NB: Ensure that there are no spaces between the variable name, assignment operator and the value

SECRET_KEY=0x!b#(1*cd73w$&azzc6p+essg7v=g80ls#z&xcx*mpemx&@9$
DATABASE_NAME=db_name
DATABASE_USER=db_user 
DATABASE_PASSWORD=password
DATABASE_HOST=localhost
DATABASE_PORT=5432

We will use django-environ for managing environment variables inside our project. So let’s install the package.

pip install django-environ

With that now, we can access the environmental variables in our codebase.

import environ

env = environ.Env()
# reading .env file
environ.Env.read_env()

# Raises django's ImproperlyConfigured exception if SECRET_KEY not in os.environ
SECRET_KEY = env("SECRET_KEY")

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql_psycopg2',
        'NAME': env("DATABASE_NAME"),
        'USER': env("DATABASE_USER"),
        'PASSWORD': env("DATABASE_PASSWORD"),
        'HOST': env("DATABASE_HOST"),
        'PORT': env("DATABASE_PORT"),
    }
}

Save the file and run the server everything should be working smoothly.

Additionally, you can also provide default values as follows.

SECRET_KEY = env("SECRET_KEY", default="unsafe-secret-key")