Never hardcode sensitive information (account credentials, passwords, etc.). Instead, create a file to store that information as environment variables (key/value pairs), and exclude that file from your source code management system. For example, in terms of Git (source code management system), exclude that file by adding it to .gitignore:
-bash> echo '/config/app_environment_variables.rb' >> .gitignore
ENV['HTTP_USER'] = 'devuser'
ENV['HTTP_PASS'] = 'devpass'
As well, add the following lines to
/config/environment.rb, between the
require line, and the
# Load the app's custom environment variables here, so that they are loaded before environments/*.rb
app_environment_variables = File.join(Rails.root, 'config', 'app_environment_variables.rb')
load(app_environment_variables) if File.exists?(app_environment_variables)
As the comment above says, by doing this you will be loading your environment variables before
environments/*.rb, which means that you will be able to refer to your variables inside those files (e.g.
environments/production.rb). This is a great advantage over putting your environment variables file inside
app_environment_variables.rb there's no need to distinguish environments as far as development or production because you will never commit this file into your source code management system, hence it is for the development context by default. But if you need to set something special for the test environment (or for occasions when you test production mode locally), just add a conditional block below all the other variables:
ENV['HTTP_USER'] = 'testuser'
ENV['HTTP_PASS'] = 'testpass'
ENV['HTTP_USER'] = 'produser'
ENV['HTTP_PASS'] = 'prodpass'
Whenever you update
app_environment_variables.rb, restart the app server. Assuming you are using the likes of Apache/Passenger or
-bash> touch tmp/restart.txt
In your code, refer to the environment variables as follows:
authenticate_or_request_with_http_basic do |username, password|
username == ENV['HTTP_USER'] && password == ENV['HTTP_PASS']
Note that inside
app_environment_variables.rb you must specify booleans and numbers as strings (e.g.
ENV['SEND_MAIL'] = 'false' not just
ENV['TIMEOUT'] = '30' not just
30), otherwise you will get the errors
can't convert false into String and
can't convert Fixnum into String, respectively.
Storing and sharing sensitive information
The final knot to tie is: how to share this sensitive information with your clients and/or partners? For the purpose of business continuity (i.e. when you get hit by a falling star, how will your clients and/or partners resume full operations of the site?), your clients and/or partners need to know all the credentials required by your app. Emailing/Skyping these things around is insecure and leads to disarray. Storing it in shared Google Docs is not bad (if everyone uses https), but I prefer a dedicated cloud-based solution for this, called Strongbox (https://www.strongbox.io/). With it, I create a new "box" for every app I am responsible for, and within each box, a new "item" for each service I sign up for (Heroku, Amazon, Google/Gmail, Google Apps etc.). As well, I create an "item" called "app environment variables", in which I create just one field and paste all the environment variables into it - I just copy/paste them in. Then I share the box with my clients and/or dev partners. Note that it is possible for you to start the box, set it all up, and then change box ownership (normally to your clients, who will pay for it).
How to set environment variables on Heroku
If you have a single environment on Heroku:
-bash> heroku config:add HTTP_USER='herouser'
-bash> heroku config:add HTTP_USER='heropass'
If you have multiple environments on Heroku:
-bash> heroku config:add HTTP_USER='staguser' --remote staging
-bash> heroku config:add HTTP_PASS='stagpass' --remote staging
-bash> heroku config:add HTTP_USER='produser' --remote production
-bash> heroku config:add HTTP_PASS='prodpass' --remote production
Foreman and .env
Many developers use Foreman (installed with the Heroku Toolbelt) to run their apps locally (as opposed to using the likes of Apache/Passenger or
rails server). Foreman and Heroku use
Procfile for declaring what commands are run by your application, so the transition from local dev to Heroku is seamless in that regard. I use Foreman and Heroku in every Rails project, so this convenience is great. But here's the thing.. Foreman loads environment variables stored in
/.env via dotenv but unfortunately dotenv essentially only parses the file for
key=value pairs; those pairs don't become variables right there and then, so you can't refer to already set variables (to keep things DRY), nor can you do "Ruby" in there (as noted above with the conditionals), which you can do in
/config/app_environment_variables.rb. For instance, in terms of keeping things DRY I sometimes do stuff like this:
ENV['SUPPORT_EMAIL']='Company Support <firstname.lastname@example.org>'
ENV['MAILER_DEFAULT_FROM'] = ENV['SUPPORT_EMAIL']
ENV['MAILER_DEFAULT_TO'] = ENV['SUPPORT_EMAIL']
Hence, I use Foreman to run my apps locally, but I don't use its
.env file for loading environment variables; rather I use Foreman in conjunction with the
/config/app_environment_variables.rb approach described above.