Environment variables for secrets in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Django settings snippet?

Given the following Django settings code that reads a secret key from environment variables, what will be the value of SECRET_KEY if the environment variable DJANGO_SECRET_KEY is not set?

Django

import os

SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'default_secret')
print(SECRET_KEY)

A default_secret

B '' (empty string)

C None

D Raises KeyError

💡 Hint

Check what os.getenv returns when the environment variable is missing and a default is provided.

The os.getenv function returns the value of the environment variable if it exists. If it does not exist, it returns the default value provided as the second argument. Here, since DJANGO_SECRET_KEY is not set, it returns 'default_secret'.

❓ component_behavior

intermediate

How does Django behave when SECRET_KEY is set from environment variables?

If you set SECRET_KEY = os.environ['DJANGO_SECRET_KEY'] in your Django settings and the environment variable DJANGO_SECRET_KEY is missing, what happens when you run the server?

Django

import os

SECRET_KEY = os.environ['DJANGO_SECRET_KEY']

A Django uses an empty string as SECRET_KEY

B Django raises a KeyError and stops running

C Django uses a default secret key automatically

D Django logs a warning but continues with a random key

💡 Hint

What does os.environ['VAR'] do if VAR is not set?

Accessing os.environ['DJANGO_SECRET_KEY'] raises a KeyError if the environment variable is not set. This stops Django from running because SECRET_KEY is required.

🔧 Debug

advanced

Why does this Django app fail to load the secret key from environment variables?

Consider this snippet in settings.py:

import os

SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')

if not SECRET_KEY:
    raise Exception('Missing SECRET_KEY environment variable')

The app crashes with the exception even though the environment variable is set. What is the most likely cause?

Django

import os

SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')

if not SECRET_KEY:
    raise Exception('Missing SECRET_KEY environment variable')

A The environment variable is set but empty string, which is falsy

B os.getenv cannot read environment variables in Django

C SECRET_KEY is set but the code has a syntax error

D The environment variable name is case-insensitive and mismatched

💡 Hint

Check what happens if the environment variable exists but is empty.

If the environment variable DJANGO_SECRET_KEY is set but empty, os.getenv returns an empty string, which is falsy in Python. The condition if not SECRET_KEY triggers, raising the exception.

📝 Syntax

advanced

Which option correctly loads a secret key from environment variables with a fallback in Django?

Choose the correct Python code snippet to load SECRET_KEY from the environment variable DJANGO_SECRET_KEY with a fallback value 'fallback_secret' if the variable is not set.

A SECRET_KEY = os.environ['DJANGO_SECRET_KEY'] or 'fallback_secret'

B SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'fallback_secret')

C SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'fallback_secret')

D SECRET_KEY = os.getenv('DJANGO_SECRET_KEY') ?? 'fallback_secret'

💡 Hint

Check Python syntax for getting environment variables with default values.

Option C uses os.getenv with a default value, which is the correct and idiomatic Python syntax. Option C uses os.environ.get, which is also valid and equivalent since os.getenv is a shorthand for it, but A uses the dedicated function. Option C will raise a KeyError if the variable is missing. Option C uses invalid syntax (?? is not Python).

🧠 Conceptual

expert

Why is it recommended to use environment variables for Django secrets instead of hardcoding them?

Select the best reason why using environment variables for secrets like SECRET_KEY is preferred over hardcoding them in Django settings.

A It allows Django to automatically rotate secrets without code changes

B It makes the app run faster by loading secrets from memory

C It enables secrets to be stored in the database securely

D It keeps secrets out of source code, reducing risk if code is shared or published

💡 Hint

Think about security and code sharing.

Using environment variables keeps sensitive data like SECRET_KEY out of the source code. This prevents accidental exposure if the code is shared publicly or stored in version control. Options B, C, and D are incorrect because environment variables do not affect app speed, automatic rotation, or database storage.

Practice

1. Why is it recommended to use environment variables for secrets in a Django project?

easy

A. To keep sensitive information out of the code and version control

B. To make the code run faster

C. To avoid writing settings.py file

D. To automatically generate secret keys

Solution

1. Step 1: Understand the purpose of environment variables

   Environment variables store sensitive data outside the code, so secrets are not exposed in files or repositories.

2. Step 2: Recognize the security benefit

   Keeping secrets out of code prevents accidental leaks when sharing or publishing code.

3. Final Answer:

   To keep sensitive information out of the code and version control -> Option A

4. Quick Check:

   Secrets outside code = safer projects [OK]

Hint: Secrets belong outside code, use env vars [OK]

Common Mistakes:

• Thinking env vars speed up code
• Believing env vars replace settings.py
• Assuming env vars auto-generate secrets

2. Which of the following is the correct way to read an environment variable named DJANGO_SECRET_KEY in Django's settings.py?

easy

A. secret_key = os.getenv('DJANGO_SECRET_KEY')

B. secret_key = os.environ['DJANGO_SECRET_KEY']()

C. secret_key = getenv.os('DJANGO_SECRET_KEY')

D. secret_key = os.get('DJANGO_SECRET_KEY')

Solution

1. Step 1: Recall correct syntax for environment variable access

   In Python, os.getenv('VAR_NAME') safely reads environment variables.

2. Step 2: Check each option for syntax correctness

   secret_key = os.getenv('DJANGO_SECRET_KEY') uses correct syntax. secret_key = os.environ['DJANGO_SECRET_KEY']() wrongly calls os.environ as a function. secret_key = getenv.os('DJANGO_SECRET_KEY') reverses function and module. secret_key = os.get('DJANGO_SECRET_KEY') uses a non-existent method.

3. Final Answer:

   secret_key = os.getenv('DJANGO_SECRET_KEY') -> Option A

4. Quick Check:

   Use os.getenv('VAR') to read env vars [OK]

Hint: Use os.getenv('VAR_NAME') to read env vars [OK]

Common Mistakes:

• Calling os.environ like a function
• Swapping function and module names
• Using non-existent os.get method

3. Given this code snippet in settings.py:

import os
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'defaultkey')
print(SECRET_KEY)

What will be printed if the environment variable DJANGO_SECRET_KEY is not set?

medium

A. An empty string will be printed

B. An error will occur because the variable is missing

C. None will be printed

D. The string 'defaultkey' will be printed

Solution

1. Step 1: Understand os.getenv default parameter

   If the environment variable is missing, os.getenv returns the default value provided as the second argument.

2. Step 2: Apply to given code

   Since DJANGO_SECRET_KEY is not set, os.getenv returns 'defaultkey', which is printed.

3. Final Answer:

   The string 'defaultkey' will be printed -> Option D

4. Quick Check:

   Missing env var returns default value [OK]

Hint: os.getenv returns default if env var missing [OK]

Common Mistakes:

• Expecting error if env var missing
• Thinking None is returned without default
• Assuming empty string is returned

4. You wrote this in settings.py:

import os
SECRET_KEY = os.getenv(DJANGO_SECRET_KEY)

But when running the server, you get a NameError. What is the problem?

medium

A. SECRET_KEY must be set manually, not from env vars

B. DJANGO_SECRET_KEY should be a string in quotes

C. os.getenv cannot be used in settings.py

D. You forgot to import dotenv

Solution

1. Step 1: Identify the cause of NameError

   NameError means the name DJANGO_SECRET_KEY is not defined as a variable in the code.

2. Step 2: Correct usage of os.getenv

   Environment variable names must be passed as strings, so it should be os.getenv('DJANGO_SECRET_KEY').

3. Final Answer:

   DJANGO_SECRET_KEY should be a string in quotes -> Option B

4. Quick Check:

   Env var names need quotes in os.getenv [OK]

Hint: Put env var names in quotes for os.getenv [OK]

Common Mistakes:

• Passing env var name without quotes
• Thinking os.getenv is disallowed in settings.py
• Assuming dotenv import is mandatory

5. You want to securely manage different secret keys for development and production in Django using environment variables. Which approach is best?

hard

A. Hardcode the production secret key in settings.py and use a dummy key for development

B. Store all secrets in a JSON file inside the project and read it in settings.py

C. Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py

D. Use the same secret key for all environments to avoid confusion

Solution

1. Step 1: Understand environment-specific secrets

   Each environment (development, production) should have its own secret key to keep them isolated and secure.

2. Step 2: Use environment variables for flexibility

   Setting DJANGO_SECRET_KEY differently in each environment and reading it via os.getenv allows safe, flexible secret management without code changes.

3. Final Answer:

   Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py -> Option C

4. Quick Check:

   Env vars per environment keep secrets safe and flexible [OK]

Hint: Use env vars per environment for secrets [OK]

Common Mistakes:

• Hardcoding secrets in code
• Sharing same secret across environments
• Storing secrets in project files