//. 095 - Managing secrets and .ENV (environment variables)
Environment variables are essential for the security and flexibility of web applications. Although the .ENV file is commonly used, it poses risks for sharing sensitive information. Alternative solutions such as password managers and secret managers provide better security for storing and sharing confidential information, particularly in collaborative development environments and cloud deployments.
Why use environment variables?
Environment variables are used in website programs for several important reasons:
*Security:* They allow sensitive information (such as API keys or passwords) to be stored outside the source code, thus reducing the risk of data leaks.
*Flexibility:* They make it easier to configure the site for different environments (development, testing, production) without modifying the code.
*Simplified deployment:* They allow the same codebase to be deployed in different environments by simply changing the environment variables.
The most widely used file management system in web development is the .ENV file.
Application security and maintainability
Tokens, passwords, etc., should not be hardcoded. - For security
For maintenance and centralization
Recent example with the Rabbit AI box and its hard-coded token leak that was in the codebase. https://www.theverge.com/2024/6/26/24...
Beware of GIT
If a token (for testing) ends up in the code committed to GIT, beware of the history / how-to-remove-env-from-git-commit-history
The disadvantages of .ENV
Confidential elements are shared as a team, and they end up on the developer's machine.
It's also a good practice for everything else: FTP access, hosting, etc.
Password manager (Dashlane / Bitwarden / ProtonPass / 1Password)
https://www.dashlane.com/fr
https://bitwarden.com/fr-fr/
https://proton.me/fr/pass
https://1password.com/
External people
It's not uncommon to have external people on teams: interns, freelancers, etc.
We end up sharing access and tokens with these people.
Fortunately, these are often development elements. But sometimes there are specific licenses paid for by the company.
Hybrid frameworks:
For a back-end framework, no problem. The default variables are never displayed on the front-end.
However, for FWs like NextJS, NuxtJS, etc., the code is shared between the SSR and the Front-End.
NextJS requires `NEXT_PUBLIC_` to make a variable publicly available.
NuxtJS allows you to use `NUXT_PUBLIC_` to place a variable in `runtimeConfig.public`.
Best practices for SSH access
SSH key
PassKey
YubiKey → https://blog.maxds.fr/ssh-with-yubikey/
Secret managers
Solutions for storing environment variables separately
[https://www.doppler.com](https://www.doppler.com/pricing) $
https://www.hashicorp.com/products/vault $$$$$
https://infisical.com/ $ + OS ❤️❤️❤️
https://www.dotenv.org/ VSCode ❤️
https://getsops.io/ OS
[https://github.com/envault/envault](https://github.com/envault/envault?ta...) self-hosted
Native in cloud providers
AWS Secret Manager
GCP Secret Manager
Azure Key Vault
Article and video:
/ its-time-to-deprecate-the-env-file-for-a-b...
Yoann Dev on Infisical • Vos SECRETS seront bien gardés avec INFISICAL
Find Double Slash on:
Twitter: / doubleslash_dev
Twitch: / doubleslash_dev
Discord: / discord
Website: https://double-slash.dev
Podcast platforms:
Google Podcast: https://bit.ly/31aKKYd
iTunes: https://apple.co/3fTguFo
Spotify: https://spoti.fi/317wtvD
Deezer: https://bit.ly/3i0hDgy
Summary
00:00:00 Introduction
00:06:20 Why we use environment variables
00:12:10 Good practice, good advice! 00:13:50 Beware of the history of versioning tools
00:14:50 Password management and access
00:19:30 Managing external parties and sharing access
00:21:30 How frameworks manage public variables
00:24:20 Managing SSH keys
00:30:15 Teamwork with environment variables
00:34:30 Secret managers
00:47:50 End