Remove hard-coded SECRET_KEY from production settings

This change moves the hard-coded key to vulnerablecode/dev.py for
use during development (e.g. DJANGO_DEV is set).

Otherwise the key is read from an environment variable with the
same name. The advantage of this approach over using a gitignored
file containing the secret is that it works with deployment
environments that use ephemeral filesystems, such as Heroku.

closes #46

Signed-off-by: Haiko Schol <hs@haikoschol.com>

Author: haikoschol

.travis.yml

@@ -7,6 +7,9 @@ services:
 install:
   - pip install -r requirements.txt
 
+env:
+  - SECRET_KEY="i1bn=oly)w*2yl-5yc&f!vvgt)p)fh3_2$r#spa!*sw36f5ov7"
+
 before_script:
   - pycodestyle --exclude=migrations,settings.py,lib,tests --max-line-length=100 .
   - psql -c "CREATE DATABASE vulnerablecode;" -U postgres

README.md

@@ -41,9 +41,15 @@ Activate a virtualenv, install dependencies, and run the database migrations:
 python3 -m venv venv
 source venv/bin/activate
 pip install -r requirements.txt
-python manage.py migrate
+DJANGO_DEV=1 python manage.py migrate
 ```
 
+The environment variable `DJANGO_DEV` is used to load settings suitable for development, defined in `vulnerablecode/dev.py`. If you don't want to type
+it every time use `export DJANGO_DEV=1` instead.
+
+When not running in development mode, an environment variable named `SECRET_KEY` needs to be set. The recommended way to generate this key is to use
+the code Django includes for this purpose: `SECRET_KEY=$(python -c "from django.core.management import utils; print(utils.get_random_secret_key())")`.
+
 ## Tests
 
 ```
@@ -53,13 +59,13 @@ python -m pytest -v vulnerabilities/tests/test_scrapers.py vulnerabilities/tests
 
 For Django based tests
 ```
-python manage.py test vulnerabilities/tests
+DJANGO_DEV=1 python manage.py test vulnerabilities/tests
 ```
 
 ## Data import
 
 ```
-python manage.py shell
+DJANGO_DEV=1 python manage.py shell
 ```
 
 ```
@@ -109,10 +115,12 @@ https://devcenter.heroku.com/articles/deploying-python#how-to-keep-build-artifac
 
 5. Create Heroku app: `heroku create`
 
-6. Deploy: `git push heroku <branch>:master`
+6. Generate a secret key and pass it as an environment variable: `heroku config:set SECRET_KEY=$(python -c "from django.core.management import utils; print(utils.get_random_secret_key())")`
+
+7. Deploy: `git push heroku <branch>:master`
 
-7. Migrate the database: `heroku run python manage.py migrate`
+8. Migrate the database: `heroku run python manage.py migrate`
 
-8. Load the data referring to chapter "Data import" above.
+9. Load the data referring to chapter "Data import" above.
 
-9. To check the logs: `heroku logs --tail`
+10. To check the logs: `heroku logs --tail`

vulnerablecode/dev.py

@@ -3,3 +3,5 @@
 DEBUG = True
 
 ALLOWED_HOSTS = ['localhost', '127.0.0.1', '::1']
+
+SECRET_KEY = 'hhismo6l@1uj)nr6@o7$b2u68w5*_o^liji+=uzq=954-f$8_1'

vulnerablecode/settings.py

@@ -12,14 +12,17 @@
 
 import os
 
+DEV_MODE = os.environ.get('DJANGO_DEV', False)
+
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'hhismo6l@1uj)nr6@o7$b2u68w5*_o^liji+=uzq=954-f$8_1'
+if not DEV_MODE:
+    SECRET_KEY = os.environ['SECRET_KEY']
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = False
@@ -28,7 +31,6 @@
     '.herokuapp.com',
 ]
 
-
 # Application definition
 
 INSTALLED_APPS = [
@@ -159,5 +161,5 @@
 
 
 # Set `DJANGO_DEV=1` in env to enable dev mode
-if os.environ.get('DJANGO_DEV', False):
+if DEV_MODE:
     from vulnerablecode.dev import *