当生成的 SECRET_KEY 以“$”开头时，如何从环境文件中转义 Django 中的 SECRET_KEY？

Question

In my Django project I have a .env file that contains the SECRET_KEY for the production settings.

I generated the secret key by running a script from the command line (Here it just prints the generated key as an example).

python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

It just so happens that a secret key was generated that started with a '$' character.

My .env file looked like this.

DJANGO_SECRET_KEY=$*%0e@-7suq*h#2(srya8n&lhb(qy+73xj_db)tpq4qenknk2%

This is read in my production settings file in the following way

import os
import environ

env = environ.Env()

# BASE_DIR is the root level directory of the project
env_file = os.path.join(BASE_DIR, '.env')
if os.path.exists(env_file):
    environ.Env.read_env(env_file=env_file) # reading .env file

SECRET_KEY = env('DJANGO_SECRET_KEY')

When I run my Django project with this secret key I get the following error

django.core.exceptions.ImproperlyConfigured: Set the *%0e@-7suq*h#2(srya8n&lhb(qy+73xj_db)tpq4qenknk2% environment variable

Because of the '$' character Django seems to think that the secret key value is an environment variable itself. This is understandable as environment variables in Bash have a '$' prefix.

But when I try changing the.env file to

DJANGO_SECRET_KEY='$*%0e@-7suq*h#2(srya8n&lhb(qy+73xj_db)tpq4qenknk2%'

or

DJANGO_SECRET_KEY="$*%0e@-7suq*h#2(srya8n&lhb(qy+73xj_db)tpq4qenknk2%"

I get the same error.

How do I escape the SECRET_KEY in an.env file on the off chance a secret key is generated with a leading '$' (that works in DJango using my production settings code)?

django version: 3.0.3

django-environ version: 0.4.5

Answer 1

This article here suggest to use pip to install dotenv and completely simplified the process of hiding the secret key. At least for beginners.

Answer 2

There seem to be two ways to solve this problem.

The first is to be explcit about what is in your .env file, using django_environ :

#.env
SECRET_KEY=(str, '$*%0e@-7suq*h#2(srya8n&lhb(qy+73xj_db)tpq4qenknk2%')

The other is to do as is indicated in the article linked to above ( https://dev.to/vladyslavnua/how-to-protect-your-django-secret-and-oauth-keys-53fl ), which effectively suggests that the same issue is present in django_environ and dotenv .

When retrieving the .env value (using dotenv ):

#settings.py
SECRET_KEY = str(os.getenv('SECRET_KEY'))

In both cases you are explicitly indicating to django that the values retrieved are strings. You could potentially run into other issues like this, and need to be explicit about the data type returned:

#.env
DEBUG=(bool, True)
SOME_INT=(int, 1)
…