1

I would like to use environment variables to securely hold secrets with pm2.

I have a reverse proxy to an express backed server that uses a database with a password each time it connects to preform a query.

I would like to access it normally from the program:

procsess.env.my_secret

but I'm assuming that simply setting the variable at run time like the following isn't safe:

MY_SECRET="secret password" pm2/node my_api_server.js

How should I set the secret password considering I'm using pm2 and I would like the variable to persist through restarts/crashes?

I should note that different environment handling and passing code to other developers through the VCN is less important to me.

2 Answers 2

2

Storing API keys or credentials using .env gets exposed to the client on Production!
By React docs -

WARNING: Do not store any secrets (such as private API keys) in your React app! Environment variables are embedded into the build, meaning anyone can view them by inspecting your app's files.

It's advised to store all env keys directly on the server and the server should be used as a mid point between the client and the API. This way the key is applied directly on the server and is not exposed in the front end. You can check out respective documentation on how to set up env variables on your particular server.

Front End Code

fetchData = () => { 
    fetch('/users', { method: 'POST', body: JSON.stringify(data) }
   .then(res => res.json())
    }

Server Code

app.post('/users', (req, res) => {
    const API_KEY = process.env.API_KEY;
    connection.query(`/apiPath/${API_KEY}`)
}
2
  • 1
    react-scripts does not dump your entire environment to the build - that would be crazy. Only env vars starting with REACT_APP_ are exposed. From the docs: By default you will have NODE_ENV defined for you, and any other environment variables starting with REACT_APP_ Commented Jun 3, 2020 at 21:53
  • 1
    @GregMichalec The docs also say "You must create custom environment variables beginning with REACT_APP_. Any other variables except NODE_ENV will be ignored"
    – Betty
    Commented Nov 10, 2022 at 16:34
0

In past ReactJS projects with Express backends that need to connect to a database, I've used the dotenv package on NPM. Once added as a dependency to your project, you will create a hidden .env file in the root of your server filestructure.

In that .env file, you can create environment variables. These variables will need to be prefixed with REACT_APP like the following:

REACT_APP_DBURI=<conn string here>
REACT_APP_MAILGUN_API_KEY=<key string here>
REACT_APP_CAPTCHA_SECRET_KEY=<key string here>

You need to require the package as follows in your code:

require('dotenv').config();

You can reference them in your server.js (or whatever) code as:

process.env.REACT_APP_VARIABLE_NAME

This Medium article has a full explanation.

Hope this helps!

3
  • No one can access it remotely and it doesn't leak in any other way?
    – S. Schenk
    Commented May 29, 2018 at 18:54
  • @S.Schenk - Not that I'm aware of. That's basically the purpose. However, I'd recommend reading the documentation and doing some googling on that question just in case. One thing to be aware of if you are planning on storing your project in a public repo such as GitHub - you will want to have the .env file listed in your .gitignore file so the .env is not publicly visible in the repository. You'll need to save that off somewhere for reference. In my understanding it is not being exposed at all if you are merely running your site on a server as normal (backend code is not exposed). Commented May 30, 2018 at 19:50
  • 4
    This is not secure at all. Everything prepended with REACT_APP in your .env file is bundled into the build and you can view it by looking in the sources tab in dev tools Commented Sep 17, 2019 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.