1

I will be working with the MariaDB Node connector over the next few days. I usually work with APIs so I'm kind of confused over how to use it.

The problem is specifically where I should keep my MariaDB login details. I had a look at the examples here, but something tells me I shouldn't have my MariaDB login details in my code during production:

const mariadb = require('mariadb');
const pool = mariadb.createPool({host: 'mydb.com', user: 'myUser', connectionLimit: 5});

Is this fine or is it a security issue? What would be the better solution in this case?

2 Answers 2

1

You shouldn't store credentials in your code repository regardless of whether it's for an API or a database, as any collaborators would then have access to your database. The most common approach is to use environment variables to make them configurable depending on which machine the code runs on.

If you are invoking Node from a Linux-like terminal such as Bash you can pass environment variables like this:

DB_HOST=mydb.com DB_USER=myUser node myscript.js

And in your code you'd access it through process.env:

const {
  DB_HOST = 'localhost', // a non-sensitive default value
  DB_USER = 'root',
} = process.env

const mariadb = require('mariadb')
const pool = mariadb.createPool({host: DB_HOST, user: DB_USER, connectionLimit: 5})

Because setting the environment variables every time you invoke the script from your terminal is tedious in the long run, bright people invented the concept of a dotenv (.env) file to store configurable variables in. The dotenv package will look for such a file and apply its values to the environment unless the properties are already defined.

Using it is as simple as creating a file called .env in your project root directory:

DB_HOST=mydb.com
DB_USER=myUser

Important: This file must be added to your .gitignore to avoid exposing your credentials to unintended viewers.

and modifying the previous script:

require('dotenv').config() // Add this to apply missing things to process.env before we read from it

const {
  DB_HOST = 'localhost',
  DB_USER = 'root',
} = process.env

const mariadb = require('mariadb')
const pool = mariadb.createPool({host: DB_HOST, user: DB_USER, connectionLimit: 5})

Further reading: The Twelve-Factor App - III. Config

1
  • 1
    I had no idea, thankfully I haven't uploaded any of my repositories publicly! Thank you for the help!
    – lpetrucci
    Sep 17, 2019 at 9:09
0

You should keep the connection details such as URL, username, and password into environment variable in production environment. You can simulate these variables in dev environment using dotenv module

Create a .env file in the root directory of your project. Add environment-specific variables on new lines in the form of NAME=VALUE. For example:

DB_HOST=localhost
DB_USER=root
DB_PASS=s1mpl3

Install dotenv with NPM: npm install dotenv --save-dev

 const dotenv = require('dotenv')
 dotenv.config();
const mariadb = require('mariadb');
const pool = mariadb.createPool({host: process.env.DB_HOST, user:process.env.DB_USER, connectionLimit: 5});

Avoid pushing .env file to code repository. use .gitigonre

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.