如何在使用Flask邮件时保持邮件密码的安全

Question

I am using flask mail to send messages from app. I am doing something like this:

app = Flask(__name__)
app.config.update(
    MAIL_SERVER='smtp.gmail.com',
    MAIL_PORT=465,
    MAIL_USE_SSL=True,
    MAIL_USERNAME = 'your@gmail.com',
    MAIL_PASSWORD = 'yourpassword'
    )
mail = Mail(app)

But I don't want my password be visible in my code. I want to encrypt it, for example. I can store in database but I still doesn't get how to keep it encrypted because I need to decrypt it to set MAIL_PASSWORD property.

Answer 1

Your app must be able to access your cleartext password, so encrypting it is useless in the scenario where the server gets compromised.

Encryption may be useful (but I don't suggest it) if you want to save it on a public place (eg code on github) and then you give the key only to the application (for example with a non tracked file or in a environment variable).

Since you must give your application some secret, I suggest you to simply give the email password as a secret.

For example using a file called local_settings.py you can do this:

# local_settings.py
MAIL_PASSWORD = 'mypassword'

# app.py
...
import local_settings

app = Flask(__name__)
app.config.update(
    MAIL_SERVER='smtp.gmail.com',
    MAIL_PORT=465,
    MAIL_USE_SSL=True,
    MAIL_USERNAME = 'your@gmail.com',
    MAIL_PASSWORD = local_settings.MAIL_PASSWORD
    )
mail = Mail(app)

Answer 2

Using environment variable is a good option (for mail password, database password, ...). Example:

import os
app = Flask(__name__)
app.config.update(
    MAIL_SERVER='smtp.gmail.com',
    MAIL_PORT=465,
    MAIL_USE_SSL=True,
    MAIL_USERNAME = 'your@gmail.com',
    MAIL_PASSWORD = os.environ['MAIL_PASSWORD']
    )
mail = Mail(app)

You can set value for MAIL_PASSWORD environment variable every time run script, using

1. In Linux: export MAIL_PASSWORD="{your_mail_password}"
2. In Windows: set MAIL_PASSWORD="{your_mail_password}"

Shouldn't use plain text in file to store password