DEV Community: Amusat Haki Adeyemi

Protect Your Sensitive Data: A Guide to .env Files in Django

Amusat Haki Adeyemi — Wed, 22 Feb 2023 19:46:39 +0000

Intro

In the last article where we discussed modularization of Django settings file, a production-ready set-up for Django applications, I mentioned that there would be a short guide on the implementation process of a dot env file in Django.

In this article, we will be going through that exactly, we will be looking at the implementation process, benefits and why you should consider using a dot env file for all your Django projects.
Let's dive in.

The Importance of `.env` Files in Django

During the developmental process of a Django application, it's common to have sensitive information such as API keys, Django secret keys, allowed hosts, database passwords, and other credentials that should not be stored in version control systems.

One way to manage these sensitive values is through the use of environment variables, which can be accessed by your code without being hard-coded into your source files.

A .env file is a simple way to manage environment variables in your Django project. It provides a way to store your environment-specific configuration in a file that can be easily managed and shared with other developers on your team, without exposing sensitive information.
There are numerous benefits of using a dot env file in django and some of them are analyzed below.

Some of the benefits of using a `.env` file in Django

Security: Sensitive information such as passwords and API keys can be kept separate from your codebase, reducing the risk of exposure to unauthorized access or accidental leaks.
Portability: With a .env file, you can easily move your application between development, staging, and production environments without having to modify your codebase.
Consistency: By storing your environment-specific configuration in a .env file, you can ensure that all team members are working with the same settings, reducing the risk of configuration drift.

Also check: Ease your way into automated testing in Django.

Implementation process of a `.env` File in Django

Here's a step-by-step guide on how to implement a .env file in your Django project, follow these steps for a quick implementation:

Install the python-dotenv package:

pip install python-dotenv

Create a file named .env at the root of your project, the same level as your manage.py. This file should not be committed to your version control (for example: Github, Gitlab, etc) system.
Add the sensitive information you want to store in your .env file. Each value should be in the format KEY=VALUE, with one variable per line. For example:

SECRET_KEY=my-secret-key
DEBUG=True
DATABASE_URL=postgres://user:password@localhost/mydatabase

In your Django settings file, import dotenv and call load_dotenv(). This will load the variables from your .env file into your environment variables.

import os
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

# Access environment variables
SECRET_KEY = os.getenv('SECRET_KEY')
DEBUG = os.getenv('DEBUG')
DATABASE_URL = os.getenv('DATABASE_URL')

With steps as simple as this, you can now use environment variables in your Django project through the .env file. You can add additional variables to your .env file as needed and access them in your code through os.getenv() is shown in the example above. Always make sure os is imported before referencing it in your project.

What you want to check now is Production ready settings file: The simplest way to get it done.

Keep in mind that it's important to keep your .env file private and not commit it to version control. You may also want to consider using a tool like git-crypt or git-secret to encrypt your .env file to further increase security.

I hope this gives you a simple overview and great guides to secure your credentials and create a far more secure Django project.

Thanks for reading, kindly consider sharing to communities where this can be found useful.

Production ready settings file: Simplest way to get it done.

Amusat Haki Adeyemi — Thu, 19 Jan 2023 11:12:29 +0000

All django projects generated from the command line using the django-admin startproject command comes with a settings file, this file is where all the configuration for your django project is kept including database configuration, static files and even secret keys.

A Django settings file contains all the configuration of your Django installation. ~ Django Docs

Since all the settings are very fragile and most of the variables decleared in the file are meant to be kept private, it's important to modularize the settings file for convenience and ease in both production and local phases of the project.

Ultimate reason for modularization would be that, most of the variables on the file eg: DEBUG, ALLOWED_HOST, etc. Would have a different value in production compare to the ones declared for them in the local environment, it is there for important to separate the production settings from developmental level settings from start.

Modularizing a django settings is very simple and pretty straight forward if done with the style introduced in this guide, however, this guide does not include environmental variables set-ups as the plan is to keep the guide simple with just a chunk at a time.
I will be publishing another article in few days that would show a quick guide on environmental variable.
Let's dive in.

Modularizing the django settings

The settings needs to be modularized for series of reasons, another of which is to keep our application safe and to reduce the workload of tweaking settings or forgetting to change some variables defined for local machine on production environment, which may prone our django project to series of injections.

Creating a settings folder The first step to take towards the modularizing concept is to create a settings directory in our main project directory, that is the directory that houses wsgi.py, asgi.py and settings.py, name the new directory: settings, then don't forget to add the __init__.py file so python would recognize this directory as a module. Move the existing settings.py file into the new settings directory and the path to settings file should look something like project_name/project_name/settings/settings.py. This little change must have breached our project, to assert this run any management command eg manage.py runserver and you should get a CommandError stating that the settings file can't be found. To rectify this issue, you need to redefine the path to settings in the manage.py file.

You want to check this article on how you can: Protect Your Sensitive Data: A Guide to .env Files in Django

modifying manage.py to accommodate the tweak Navigate into the manage.py file and you should find the generic management template django generated with the django-admin startproject command, the manage.py file should look something like this:

#!/usr/bin/env python
"""Django's command-line utility for administrative tasks."""
import os
import sys


def main():
    """Run administrative tasks."""
    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project_name.settings')
    try:
        from django.core.management import execute_from_command_line
    except ImportError as exc:
        raise ImportError(
            "Couldn't import Django. Are you sure it's installed and "
            "available on your PYTHONPATH environment variable? Did you "
            "forget to activate a virtual environment?"
        ) from exc
    execute_from_command_line(sys.argv)


if __name__ == '__main__':
    main()

You will have to modify the path to settings by changing the path to settings file, so the new path together with manage.py file would look something like this:

#!/usr/bin/env python
"""Django's command-line utility for administrative tasks."""
import os
import sys


def main():
    """Run administrative tasks."""
    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project_name.settings.settings')
    try:
        from django.core.management import execute_from_command_line
    except ImportError as exc:
        raise ImportError(
            "Couldn't import Django. Are you sure it's installed and "
            "available on your PYTHONPATH environment variable? Did you "
            "forget to activate a virtual environment?"
        ) from exc
    execute_from_command_line(sys.argv)


if __name__ == '__main__':
    main()

If you run a management command now, it should run as normal.

Modularizing settings for different environments

You want to start by creating two new files in the settings module/directory, one would be named local_settings.py and the other named production_settings.py for our local and production environments respectively.

Now you copy everything in the settings file into the two other file by pasting the code below in both of them.

from .settings import *

Line import * would copy everything in the settings file into the two of them meaning we now have two separate settings file for two environments and we have the generic settings file as base.

Configurating management to run the correct setting file based on the environment The most important concept here is to understand the key difference between the production environment and local environment, the variable DEBUG in django settings is what allows django to show path to errors, give details about errors and all available paths in a django application and it is meant to be set to True if you're in local environment so you can easily debug your code and False in the production environment so django would be able to throw appropriate error when needed and not cast all the secret details about the project.

Knowing this, you'll be using the DEBUG settings in the management file to configure django so that it would run the correct settings at the correct environmet.

See this article: Ease your way into automated testing in Django.

The step to this is to import the base settings file and check if DEBUG is true, if it is, django run the local settings and if it's not, django run the production settings. So the code in the management file would look something like this:

#!/usr/bin/env python
"""Django's command-line utility for administrative tasks."""
import os
import sys
from your_project_name.settings import settings

def main():
    """Run administrative tasks."""
    if settings.DEBUG:
        os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project_name.local_settings')
    else:
        os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project_name.settings.production_settings')

    try:
        from django.core.management import execute_from_command_line
    except ImportError as exc:
        raise ImportError(
            "Couldn't import Django. Are you sure it's installed and "
            "available on your PYTHONPATH environment variable? Did you "
            "forget to activate a virtual environment?"
        ) from exc
    execute_from_command_line(sys.argv)


if __name__ == '__main__':
    main()

This is a clever way and you are now assured that django would always run the correct settings based off the environment you're, to affirm that this settings work, go into the base settings file and set the ALLOWED_HOST=['*'], then tweak the DEBUG variable from True to False, run the server with manage.py runserver command and you should see from the log on the command line that django runs the local settings when debug is True and it runs the production settings when it's False.
After modularizing the settings, the next big thing to do in order to keep the project safe is to set up environmental variables and keep the special variable values in them, hence the project would be always ready for production.

In conclusion, I hope you learn something even if it's significantly small, kindly follow me on Linkedin for I share a link to my latest articles on it always.

Thanks for reading.

Ease your way into automated testing in Django.

Amusat Haki Adeyemi — Thu, 12 Jan 2023 13:00:16 +0000

Significance of software testing

Automated testing is an extremely useful bug-killing tool for the modern web developer. ~ Django Docs

Without automated testing, Software developers would neither have a way to affirm the quality of their code, nor would there be a way to assure that the code does the job it's written to do, until it get deployed and becomes available to users that's when they would have to wait for users feedback.

Writing Tests for any project has become the norm and industrial standard to a point where a programmer can not be taken serious until he writes full functional and unit test for his project and have them go green.

Automated testing is a process that validates if software is functioning appropriately and meeting requirements before it is released into production. This software testing method uses scripted sequences that are executed by testing tools.

Also check this short article on how to: Protect Your Sensitive Data: A Guide to .env Files in Django

Approach to automated testing

This days, there are many approach to testing a software application and the rise in demand of Test first approach amongst programmers is noticeable, you must have heard about "Test Driven Development (TDD)" if at all you belong to any developer community, in which case test is written first before code implementation, and it is written because the programmer wants it to fail, after which he write codes that would make the tests go green (i.e. passed), the code is written to satisfy the test which is basically the desired output.

The main and most common approach to programming is behavior-driven development (BDD) in which case you develop to satisfy a development plan after which you test to assure quality as opposed to TDD where you develop to satisfy test, then optimize.

Either way, testing a software project is not a joke and must be taken as an important aspect if not the most important aspect of the project, no matter the level of experience the programmer has.

Testing environment

Testing a web application is a complex task, because a web application is made of several layers of logic – from HTTP-level request handling, to form validation and processing, to template rendering. ~ Django Docs

Proper testing environment set-up is a tedious work because it often require going back and forth between documentations and terminal and having allot of config files to set up so as to assert smooth testing experience once development starts.

You need to see this article on Production ready settings file: Simplest way to get it done

Testing in Django

Django as a battery included framework ship all app generated through the management command python manage.py startapp for windows and python3 manage.py startapp for Mac or Linux with inbuilt test suite configured in a python file named test.py where the TestCase a class from the test module has already been imported at the top of the file.

But the growth of our project would render the test file irrelevant due to the fact that several layer of the app needs require testing and keeping all this in a file wouldn't make any sense, it would rather reduce the readability of the code and end up ruining things when change is required instead of making things better.

Steps to set up a proper testing environment in django

In order to have a proper testing environment that requires a one time configuration and would suffix for any project size, we would need to employ some python third party frameworks to help ship our tools faster.
But as project application grows, tests would become more difficult to manage or work with if they’re all saved in a single test file, and also. There are some limitations with Django-inbuilt test suit which can all be handled by python testing library (Pytest).

In this article, we’ll be learning how to efficiently configure pytest into Django and make them sync with each other and blend well. This would breath ease into your journey of unit testing, Functional testing and System testing.

Steps

Delete the Django follow-come test-file and creation of a tests folder.

This step is pretty straight forward, we want to go into our app folder, the same folder that hosts the Models, Views and Apps file and delete tests.py file.
After deleting the file, create a new folder and name it tests, then inside the tests folder, create a new file named __init__.py this is because without initializing it as a module, python wouldn't recognize it as one.

Pytest Installation and Setup

Now, we install our testing library and configure it to work extremely well with our Django project.

Install pytest-django via pip

Go to your browser and search for pytest-django click on the link that leads to their documentation and copy the pip command to install the package, which is just pip install pytest-django, paste this command in your terminal or CMD if you're on windows, then click enter to run the command.

Please note that Pytest is a dependency for pytest-django, so it would install Pytest and other Pytest's dependencies alongside it, pytest-django just provides an extremely easy way for us to use the Pytest package in our Django environment.
To be sure that the package is successfully installed, run pytest in the terminal or CMD and it should return some commands that ends with ===========no tests ran in 0.00s===========, if the case is different for you, then you would need to reinstall the pytest-django library.

Creation and setup of pytest.ini file.

In the project folder, the same level with manage.py file, create a new file named pytest.ini, this is Pytest initiation file that would be run first anytime you run Pytest.
Inside this file we want to initiate Pytest, provide route to our settings module and define the orientation of all tests file, i.e. the type of files pytest should crawl for testing.
Paste this block into your pytest.ini file.

# project_name/pytest.ini
[pytest]
DJANGO_SETTINGS_MODULE = project_name.settings
python_files = test_*.py

Run pytest in the terminal or CMD again and it should return the same log as before but with very slight delay in time, which shows that pytest is trying to initiate itself with our .ini file.

Run an example test.

Now, we can go back into our test folder and create an example test to be sure our pytest is well configured.
Inside the tests directory, create a new file named test_example.py and paste the dummy code block below in it.

# app_name/tests/test_example.py
def test_dummy_example():
    assert 2 == 2

Of course this is expected to return True, but it's called dummy-test because we want to use it to test-run our project and be sure that all is well.
If you run pytest in the terminal or CMD now, it should return a log that that specify the test folder with the percentage of it's tests that passed and the log should end with ============= 1 passed in 0.01s ============.

Also note that if we're to replace the code block by the one below, the test would fail and pytest does a really good job by letting you know where exactly something went wrong so that you may fix it for ease.

# app_name/tests/test_example.py
def test_dummy_example():
    assert 2 == 1

This is the end to this extremely simple guide to testing, I hope this helps and you now understand the reason why you must write tests for your projects even if it's just some dead simple unit test.
Every programmer should get used and comfortable to testing and it's environment and this would give you confidence on the code you wrote.

Do you also say "Praise be to God" whenever your tests goes green?

Best way to deliver this content.

Amusat Haki Adeyemi — Tue, 13 Dec 2022 14:02:02 +0000

I'm still looking for the best way to relate the complete journey in such a way that it'll provide value to anyone that hopefully come across it.

I want it to be in such a way that there'll be zero ambiguity in code explanation, just pure language explained in the best and simplest way while making sure I provide the best solution to each and every one of the question.
Insha Allah, I'll be starting soon.

Series explaining how I'm preparing for my Upwork Academy Skill Assesment exam.

Amusat Haki Adeyemi — Tue, 06 Dec 2022 21:33:29 +0000

I've chosen to document my way into passing the Upwork skill assessment. I got invite to the assessment some two weeks ago and when I tried getting resources to study ahead of it, I nearly couldn't find one, aside a Reddit user who told me to prepare on Codesignals for the general assessment.

even after getting this info, there are little to zero deep explanation for the solutions on codesignal question especially for a self thought engineer to understand.

So, I picked up the challenge to document my way into solving the algorithms and to give clear explanation of how I end up solving each of them, watch this space for the series.

Kindly wish me luck as I'm still preparing for the exam amidst two heavy projects that I'm working on all alone. Hoping to get trough everything before the end of January.