-
Notifications
You must be signed in to change notification settings - Fork 75
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add an option to blacklist or whitelist some keys from .env file #41
Comments
@fakiolinho I see what you mean about leaking this information into the client, however I also would love to fix this so that it doesn't bundle the whole One of the cool things about webpack is its ability to minify your code in an impressive way: const test = true
if (test) {
console.log('yes')
} else {
console.log('nope')
}
// becomes...
if (true) {
console.log('yes')
} else {
console.log('nope')
}
//becomes
console.log(yes) That being said, it would be great if we could somehow resolve the plugin to determine which env variables are loaded, and only bundle those. i.e. //instead of:
console.log({"DB_PASSWORD":"test1234", "NODE_ENV":"production"}.NODE_ENV)
//it would just simply do:
console.log("test1234") |
@mrsteele i 'd like to help with this but i am not sure i got you 100%. Let's say we have this DB_USER='root'
DB_PASS='root'
API_URL=https://someurl.com:9000 I need to use just 1 const varsToBundle = _.omit(parsedVars, ['DB_USER', 'DB_PASS']); Am i correct or i am missing sth? |
Have a look here in the second example: https://webpack.js.org/plugins/define-plugin/ |
I think all we would have to do is map over the keys appropriately in the define plugin portion: https://github.com/mrsteele/dotenv-webpack/blob/master/src/index.js#L58 should be: return new DefinePlugin({
'process.env.var0': var[0],
'process.env.var1': var[1],
// etc...
}) |
@fakiolinho (and @j-feng13 this effects you too), I was able to resolve any leaky data be defining each env variable individually. Please have a look at let me know what you think. |
@fakiolinho with my enhancement to the approach with DefinePlugin, you can have include all ENV variables and not have to worry about leaking sensitive information because the bundler only writes things that you use. |
|
@mrsteele thanks for your great solution. It works like a charm!!!!! Thanks. Now you can sleep tight, hahaha!! |
I think this is a dangerous foot gun. I think the |
@levino a lot of people create a “client.env” and use that instead of sharing that with server stuff to avoid that situation. |
I think that adding an option to omit some critical keys like passwords from our bundle is crucial to protect our application from potential security holes. Most of the times in
.env
files there are some critical keys like DB credentials, tokens etc so if we pass all these throughDefinePlugin
into our bundle things might get ugly. I propose to add at least one option to blacklist or whitelist some keys so we can do sth like:The text was updated successfully, but these errors were encountered: