How to I hide my secret_key using virtualenv and Django?

Question

I am using Django, python, virtualenv, virtualenvwrapper and Vagrant.

So far I have simply left my secret_key inside of the settings.py file. This works file for local files. However I have already placed my files in Git. I know this is not acceptable for production(Apache).

What is the correct way to go about hiding my secret_key?

Should I use virtualenv to hide it?

You have two ways to do it below. Just wanted to point out a warning: if you have your key in your repo now, change your key! — Ryan O'Donnell, Aug 07 '15 at 17:55
@RyanO'Donnell That's really only necessary if your repo is public, though. If your repo is only on your server and no one else has access, it's not that bad. If it's on GitHub as a public repo, that's bad. — Alex Van Liew, Aug 07 '15 at 18:02
True, however, who knows what you'll do with it in the future :) — Ryan O'Donnell, Aug 07 '15 at 18:19

score 18 · Accepted Answer · answered Aug 07 '15 at 18:00

There's a lot of different methods to hide secrets.

Use another, non-versioned file.

Create a new file secrets.py or what have you and put your secrets in that. Place it alongside your settings file and place everything secret in there; then in your settings file put from secrets import * at the top. Then, like Rahul said, add a .gitignore file and add secrets.py to this file so that it won't be committed.

The disadvantage of this approach is that there is no source control at all on that file; if you lose it you're SOL.
Use environment variables.

Use the Apache SetEnv or PassEnv directives to pass environment variables to your process, then retrieve them with os.environ() in your settings file. This has the advantage in that in development, you can set new variables (as simply as VAR1=whatever VAR2=whatever ... ./manage.py runserver ...) or set them from whatever mechanism you use to launch your development project.

The disadvantage is much the same; if you lose your Apache configs you're boned.
Use a second repository in combination with method 1.

Personally, I like the idea of having a dedicated secrets repository that you put all your secrets into and keep that repo under lock and key. Then as part of your deployment process, you can use git archive or another similar command to extract the proper keys for the place you're deploying to, and you can keep your secrets backed up and under version control easily. You can also add the appropriate files in the secrets repo to the .gitingore file of your site repository so that they don't accidentally get committed.

The downside of this is that you have another extra repository and another deployment step. I think that's worth it, personally, but it's really up to you.

In general, the more secure you want it, the more inconvenient it's going to be to access those secrets. That's really a rule in general, though.

Once you add from secrets import * how do you access the variable in settings.py? — Jake Mulhern, Jan 27 '21 at 02:15

Rahul Gupta · Answer 2 · 2015-08-07T18:03:11.163

17

You can create a file named secret_settings.py and place your SECRET_KEY inside this file. Then add this file to .gitignore. Then in your settings, you can remove the secret key variable and import it from there. This should ensure that SECRET_KEY variable remains out of version control.

Create a file named secret_settings and then place your SECRET_KEY and other secret settings in it.

SECRET_KEY = .. # add your setting here

Then in your settings.py file, import these settings.

from secret_settings import *

Finally, add secret_settings.py to your .gitignore file.

Note:

If you already have committed some sensitive data to your repo, then change it!

As per Github website in the removing sensitive data article:

If you committed a password, change it! If you committed a key, generate a new one.

Check this link on how to purge a file from your repository's history.

edited Aug 07 '15 at 18:03

answered Aug 07 '15 at 17:39

Rahul Gupta

46,769
10
112
126

this answer was the cleanest approach for me! – 1QuickQuestion Jul 01 '20 at 14:31
@Rahul Gupta, dont we need a secret key for deployment ? – Talha Anwar Jul 16 '20 at 19:05
1

For me, I needed to include a dot in this part: from .secret_settings import * – Claudio Shigueo Watanabe Feb 27 '21 at 03:39

score 2 · Answer 3 · answered Aug 07 '15 at 17:37

Common approach, if you'd like to configure region, but did not want to store sensitive information in repo, is to pass it through environment variables. When you need it just call os.environ('SECRET') (even in your settings.py). Better with some fallback value.

Virtualenv does not helps you to hide anything, it just prevent you system-wide Python installation from littering by one-project-required-packages.

score 0 · Answer 4 · answered Aug 08 '20 at 04:38

The solution I use is to create a file sec.py and place it next to my settings.py file. Then in at line 1 of settings.py call from .sec import *. Be sure to include the period in front of the file name. Be sure to list sec.py in your .gitignore file.

score 0 · Answer 5 · answered Apr 04 '23 at 17:05

I create an .env file in the root directory of the project. Next, I copy SECRET_KEY to the .env file. I remove quotes from the key and spaces (SECRET_KEY=django-insecureхjsdsdk 8747373884dydfds)). Next, install the pip install python-decouple library. After I do the import in settings.py - from decouple import config. Further in the field SECRET_KEY = config('SECRET_KEY'). Don't forget to add .env in gitignore.

How to I hide my secret_key using virtualenv and Django?

5 Answers5

Use another, non-versioned file.

Use environment variables.

Use a second repository in combination with method 1.

Linked