How to Use dotenv in Express
By: Jordan Moore
Tags: Coding, JavaScript, Software Development, Expressjs, Programming

How to Use dotenv in Express

Modern applications use all sorts of data.

Sometimes, data is used for authenticating into third-party services, connecting to a database, or any other myriad options. In the example of a database connection, the necessary data would be the developer’s username and password, along with a number of other required parameters.

In order to do this, an application must have access to that data. This means that the data must be stored somewhere that the application can access it.

The easiest place to store the data is right in the source code. However, this introduces a security problem for a developer’s data as the data is private and should not be available to those who can see the source code.

This article will take a problem-centered approach in explaining why developers use dotenv to remedy this problem, which will then be followed by a quick demonstration of how to use the package in question.

The Problem

Storing data in the source code is something developers do every day. However, when storing sensitive data, this becomes a problem.

Sensitive data might be any of the following:

AWS credentials;

Database credentials;

Auth0 credentials;

The problem arises with collaboration and public visibility of a project’s source code.

Most developers use a version control system (VCS) to manage projects. One popular example is GitHub. When a developer pushes their source code onto a VCS, that code is hosted and visible by a third-party (the VCS) and any other developers who have privileged access to the developer’s repository (collaborators). Not only that, but the VCS typically stores a history of all the states of the project, which means that removed data may still be visible after its deletion.

Since the source code is visible to anyone who has access, all of the data that is stored in the application’s source code is visible. Sensitive data, as a result, is compromised. Developers cannot be sure exactly who has access to their sensitive information, as the data may spread in a wild, runaway game of telephone.

This problem of compromised data is a nasty one. There is a solution, though.

dotenv as a Solution

dotenv is an NPM package for storing sensitive data in environment variables.

Environment variables are external to an application. Developers can think of them as configuration data that are stored either in a machine’s OS or application’s running container. These variables are configured dynamically at runtime and can change based on the environment that the application is run.

Environment variables are a great solution to the problem of securing sensitive data.

Instead of specifying the exact data that a specific developer uses to run the application on their machine, the application can reference environment variables to find the necessary data. So, instead of pushing sensitive data to one’s VCS, a developer would push source code which made reference to environment variables that are stored on a developer’s source code locally.

In order to avoid pushing the local dotenv file to the VCS, it is ignored by the VCS’ designated ignore-file.

Setting up the Demo App

We will use the command express --view=pug dotenv-demo to set up our dotenv demo.

After running the command, cd dotenv-demo .

We will only need to install one dependency for this project, and that is an obvious one: dotenv . Run the command npm i dotenv to install it in package.json .

Finally, install the modules with npm i .

Creating the necessary files

Create two files in the root of the project: .gitignore and .env .

.env will be used to store our local environment variables and .gitignore will be used to ensure that .env is not pushed to GitHub.

Open .gitignore and add the following code:

Simple, right? Now, .env will not be pushed to GitHub (so long as we haven’t already committed prior to writing the gitignore ). Our environment variables are local to our machines.

dotenv in action

We will need some data to test that dotenv is actually working. First, we will need to specify that our application should use dotenv to load environment variables from .env .

Open up app.js and make it look like the following code snippet:

The first line is the only important one. This line requires dotenv and makes environment variables from .env accessible to the process.env object in NodeJS.

Next, let’s add some data to .env that will be displayed on the / path:

SAMPLE_DATA is the name of the environment variable and dotenv is working! is the value of it.

Open up the file ./routes/index.js and modify the code to match the following code:

The environment variables are stored on the process.env object. SAMPLE_DATA is the name of the variable that we wrote in the previous step.

Now, test the application with npm start . Go to the / path and see if the environment variable has been extracted and displayed on the page. The output should look like:

Woo!

Great — it’s working. Now our value for SAMPLE_DATA is safe, and any other collaborating developer can use a .env file to substitute their own value for that variable without needing to rely on someone else’s data.

Thanks for reading this and happy coding!