Environment variables for secrets in Django - Mini Project: Build & Apply

Environment variables for secrets in Django

📖 Scenario: You are building a Django web application that needs to keep sensitive information like the secret key safe. Instead of writing the secret key directly in the code, you will use environment variables to store and access it securely.

🎯 Goal: Learn how to set up and use environment variables in Django to keep secrets like SECRET_KEY outside your code files.

📋 What You'll Learn

Create a .env file with the secret key

Load environment variables in Django settings

Use the environment variable for SECRET_KEY

Add fallback default for SECRET_KEY

💡 Why This Matters

🌍 Real World

Keeping secret keys and passwords out of code helps protect your app from leaks and makes it easier to change secrets without changing code.

💼 Career

Many companies require secure handling of secrets in web apps. Knowing environment variables is a key skill for Django developers.

1

Create a .env file with the secret key

Create a file named .env in your project root folder. Inside it, write the line SECRET_KEY='django-insecure-12345' exactly as shown.

Django

# Create a .env file with the line SECRET_KEY='django-insecure-12345'

Hint

The .env file stores environment variables as key=value pairs. Use single quotes around the value.

2

Install and import python-dotenv to load environment variables

In your Django settings.py file, add import os and from dotenv import load_dotenv at the top. Then call load_dotenv() to load variables from the .env file.

Django

import os
# Import load_dotenv and call it below
# Your code here

Hint

Use pip install python-dotenv before running your project to install the package.

3

Use environment variable for SECRET_KEY in settings.py

Replace the existing SECRET_KEY assignment in settings.py with SECRET_KEY = os.getenv('SECRET_KEY') to get the secret key from the environment variable.

Django

import os
from dotenv import load_dotenv

load_dotenv()

# Set SECRET_KEY from environment variable
# Your code here

Hint

Use os.getenv('SECRET_KEY') to read the variable from the environment.

4

Add a fallback default for SECRET_KEY

Modify the SECRET_KEY assignment to provide a fallback string 'fallback-secret-key' if the environment variable is missing. Use SECRET_KEY = os.getenv('SECRET_KEY', 'fallback-secret-key').

Django

import os
from dotenv import load_dotenv

load_dotenv()

# Add fallback default for SECRET_KEY
# Your code here

Hint

The second argument to os.getenv is the default value if the variable is not set.

Practice

1. Why is it recommended to use environment variables for secrets in a Django project?

easy

A. To keep sensitive information out of the code and version control

B. To make the code run faster

C. To avoid writing settings.py file

D. To automatically generate secret keys

Solution

1. Step 1: Understand the purpose of environment variables

   Environment variables store sensitive data outside the code, so secrets are not exposed in files or repositories.

2. Step 2: Recognize the security benefit

   Keeping secrets out of code prevents accidental leaks when sharing or publishing code.

3. Final Answer:

   To keep sensitive information out of the code and version control -> Option A

4. Quick Check:

   Secrets outside code = safer projects [OK]

Hint: Secrets belong outside code, use env vars [OK]

Common Mistakes:

• Thinking env vars speed up code
• Believing env vars replace settings.py
• Assuming env vars auto-generate secrets

2. Which of the following is the correct way to read an environment variable named DJANGO_SECRET_KEY in Django's settings.py?

easy

A. secret_key = os.getenv('DJANGO_SECRET_KEY')

B. secret_key = os.environ['DJANGO_SECRET_KEY']()

C. secret_key = getenv.os('DJANGO_SECRET_KEY')

D. secret_key = os.get('DJANGO_SECRET_KEY')

Solution

1. Step 1: Recall correct syntax for environment variable access

   In Python, os.getenv('VAR_NAME') safely reads environment variables.

2. Step 2: Check each option for syntax correctness

   secret_key = os.getenv('DJANGO_SECRET_KEY') uses correct syntax. secret_key = os.environ['DJANGO_SECRET_KEY']() wrongly calls os.environ as a function. secret_key = getenv.os('DJANGO_SECRET_KEY') reverses function and module. secret_key = os.get('DJANGO_SECRET_KEY') uses a non-existent method.

3. Final Answer:

   secret_key = os.getenv('DJANGO_SECRET_KEY') -> Option A

4. Quick Check:

   Use os.getenv('VAR') to read env vars [OK]

Hint: Use os.getenv('VAR_NAME') to read env vars [OK]

Common Mistakes:

• Calling os.environ like a function
• Swapping function and module names
• Using non-existent os.get method

3. Given this code snippet in settings.py:

import os
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'defaultkey')
print(SECRET_KEY)

What will be printed if the environment variable DJANGO_SECRET_KEY is not set?

medium

A. An empty string will be printed

B. An error will occur because the variable is missing

C. None will be printed

D. The string 'defaultkey' will be printed

Solution

1. Step 1: Understand os.getenv default parameter

   If the environment variable is missing, os.getenv returns the default value provided as the second argument.

2. Step 2: Apply to given code

   Since DJANGO_SECRET_KEY is not set, os.getenv returns 'defaultkey', which is printed.

3. Final Answer:

   The string 'defaultkey' will be printed -> Option D

4. Quick Check:

   Missing env var returns default value [OK]

Hint: os.getenv returns default if env var missing [OK]

Common Mistakes:

• Expecting error if env var missing
• Thinking None is returned without default
• Assuming empty string is returned

4. You wrote this in settings.py:

import os
SECRET_KEY = os.getenv(DJANGO_SECRET_KEY)

But when running the server, you get a NameError. What is the problem?

medium

A. SECRET_KEY must be set manually, not from env vars

B. DJANGO_SECRET_KEY should be a string in quotes

C. os.getenv cannot be used in settings.py

D. You forgot to import dotenv

Solution

1. Step 1: Identify the cause of NameError

   NameError means the name DJANGO_SECRET_KEY is not defined as a variable in the code.

2. Step 2: Correct usage of os.getenv

   Environment variable names must be passed as strings, so it should be os.getenv('DJANGO_SECRET_KEY').

3. Final Answer:

   DJANGO_SECRET_KEY should be a string in quotes -> Option B

4. Quick Check:

   Env var names need quotes in os.getenv [OK]

Hint: Put env var names in quotes for os.getenv [OK]

Common Mistakes:

• Passing env var name without quotes
• Thinking os.getenv is disallowed in settings.py
• Assuming dotenv import is mandatory

5. You want to securely manage different secret keys for development and production in Django using environment variables. Which approach is best?

hard

A. Hardcode the production secret key in settings.py and use a dummy key for development

B. Store all secrets in a JSON file inside the project and read it in settings.py

C. Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py

D. Use the same secret key for all environments to avoid confusion

Solution

1. Step 1: Understand environment-specific secrets

   Each environment (development, production) should have its own secret key to keep them isolated and secure.

2. Step 2: Use environment variables for flexibility

   Setting DJANGO_SECRET_KEY differently in each environment and reading it via os.getenv allows safe, flexible secret management without code changes.

3. Final Answer:

   Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py -> Option C

4. Quick Check:

   Env vars per environment keep secrets safe and flexible [OK]

Hint: Use env vars per environment for secrets [OK]

Common Mistakes:

• Hardcoding secrets in code
• Sharing same secret across environments
• Storing secrets in project files