search

Dindaleon / hapi-react-starter-kit

A hapi React Starter kit with react-router, redux, react-transform
172 stars 29 forks source link

Leaking sensitive information? #23

Open benderunit opened 8 years ago

benderunit commented 8 years ago

Is this http://hapi-reactstarterkit.rhcloud.com/ an example for running this starter kit in an production environment? If it is, I think it's leaking sensitive informations through the running webpack server. It serves informations like the iron secret through the config.js file.

Dindaleon commented 8 years ago

@benderunit Yes indeed. What do you suggest? Perhaps, having the secret key as environment variable?

nym commented 8 years ago

Does it exhibit the same problem when running as prod?

FullStackForger commented 8 years ago

No it does not @nym You can run it

SECRET="YOUR_SECRET_KEY" node server.js

with key set to your environment. This is how it is done to protect code from commiting sensitive information into repositories.