Environmental Variables & Hiding Sensitive Information in Ruby
Tags: ruby, sinatra, security, tutorial
Published: 2019-10-25 22:04:25

---
title: Environmental Variables & Hiding Sensitive Information in Ruby
published: true
date: 2019-10-11 21:38:17 UTC
tags: ruby, sinatra, security, tutorial
canonical_url: https://shannoncrabill.com/blog/hiding-sensitive-information-with-environmental-variables-in-ruby/
cover_image: https://shannoncrabill.com/blog/wp-content/uploads/2019/10/michael-dziedzic-pM9pkc9J918-unsplash.jpg
---

Recently, I learned about user sessions in Sinatra. It involves setting `set :sessions, true` and assigning a secret key or word to that session.

Which had me thinking, what is the purpose of a _secret_ word if it can be seen in a public Github repository? 🤔

![A locked door that can easily be opened from the otherside](https://media.giphy.com/media/SkDk7oyyKVNkc/giphy.gif)

I heard of [environmental variables](https://medium.com/chingu/an-introduction-to-environment-variables-and-how-to-use-them-f602f66d15fa) and wanted to see if that would work here. I found several references to hiding sensitive information or API keys but none that fit in the context of my project.

With trial, error, and help from the Flatiron community, I figured out a way to hide sensitive information using environmental variables and the [dotenv](https://github.com/bkeepers/dotenv) Ruby gem.

This post outlines how to set up environmental variables and some common gotchas that you may run into.

_Note: I have written these directions in the context of the Sinatra project that is part of the Flatiron School Software Engineering course. The principles can work for other setups but may require revisions. If you are a Flatiron student working on this project, I highly recommend starting with the [Corneal](https://github.com/thebrianemory/corneal) framework._

## Setup

* In your project repo’s, `Gemfile` add `gem 'dotenv'`.
2. In `environment.rb` ( this is located within the `/config` directory if you are using Corneal) add the following:  

```ruby
require 'dotenv'
Dotenv.load
```

I added mine after `ActiveRecord::Base.establish_connection` although you may be able to place it elsewhere within the file.

* Run `bundle install`.
4. In the root directory of your project, if you do not already have them, create a `.gitignore` and `.env` file.  

* Within `.gitignore` add `.env`.Any files or directories listed within `.gitignore` are now _not_ being tracked by Git. Changes to the `.gitignore` should be tracked, committed and pushed to your remote repo. **Your `.env` should not be tracked, committed or pushed to a remote repo**.

You can now use the `.env` file to keep API keys, session secrets and more. To do that, assign a key and it’s value using this syntax:

```ruby
NAME_OF_KEY="This is the value of NAME_OF_KEY"
```

In your project files, reference that value by using `ENV["NAME_OF_KEY"]`. Since `.env` is not tracked or pushed to your remote repo, your code will only contain the _reference_ to the value instead of the value it’s self.

## Troubleshooting

I ran into several issues with my app not loading after starting the server. Installing the dotenv with `gem install dotenv` did not seem to work, but manually adding it to the `Gemfile` did.

If `bundle install` has been run and there are still unexpected results, double-check value names and where they are being called. For example, `ENV["NAME_OF_KEY"]` may need to be escaped if it is part of a string or within a `.erb` file.

## Is anything safe?

Not really.

If you have previously committed or pushed sensitive information to a repo, consider it stolen. Update any passwords or generate new API keys as soon as possible. [Sensitive information can be removed from Github](https://help.github.com/en/articles/removing-sensitive-data-from-a-repository), and [previous commits can be reverted](https://code.likeagirl.io/how-to-undo-the-last-commit-393e7db2840b) but that information _may_ exist in a forked repo on someone else’s computer. Even if a repo is private, that information still exists on a server somewhere. If someone gained access to that server who shouldn’t (hello data breaches), they will have access to that information.

I am not trying to scare you. Just to think about what information you are posting on the web.

### References

- [Where to store sensitive data in public rails app?](https://stackoverflow.com/questions/6113042/where-to-store-sensitive-data-in-public-rails-app/11300680#11300680)
- [Hide API Keys from git and github](https://medium.com/@jamesjsewell/hide-api-keys-from-git-and-github-9ef1f0e4acf6)

[Photo by Michael Dziedzic on Unsplash](https://unsplash.com/photos/pM9pkc9J918)

The post [Hiding Sensitive Information with Environmental Variables in Ruby](https://shannoncrabill.com/blog/hiding-sensitive-information-with-environmental-variables-in-ruby/) appeared first on [Shannon Crabill — Front-End & Email Developer](https://shannoncrabill.com/blog).