In the last video, we saw how in the database, but there is one pain point that is anyone will have
access to or just can see the secret OK by just console logging it.
And also they can see the password by using find one method to how to wipe that sticky from that users
will have access to.
That is by using what are in dark and file.
So basically, environment variables are very, very simple file that we are going to keep certain sensitive
variables such as encryption keys and API keys.
So for that first thing you have to do is npm install dot e and OK, so dot and meet and and be in package.
So as you can see it.
This is a.
This is the package, the first thing and being installed at the end.
So then the usage will be required to and read golfing.
So basically, we are doing that here in the U.S. we are requiring not and and then configuring.
So after doing that, what we have to do is just create a file called and in the derby and you can you
can basically store all the keys in the EPA securities that you want.
Here, I'm installing my secret key as this is my secret.
You can have any string.
It's OK, you can have any string that you want.
This will vary from user to unit the secret key.
So there's going to be this is the secret game starting in the dark and refine and know how to use it.
So this process in this you have to use one statement process dot e and this will look to this file
to process our DNA and then dot whatever variable you want.
Dark Secret Keyboard Player And I do not blame Secret Dot app idea, dark secret, anything.
Whatever you want, you can do that.
So basically what this client decline secret and everything, we will see this in the final level of
security that is authentication with Google, Google or Facebook or that kind of stuff.
We'll see that in the last few areas of this project.
And this is how they end with fireworks.
Now.
Here.
You can basically call this secret geese using that, and we fi like process, dark energy, dark secret
key and then.
Let me show you, yeah, so here, instead of constantly correct physical store, we can remove this
line of code.
And then here insert of secret key, we can bust, process, lock any dot and then.
Not captains all kept secret.
So this will be will be used to hide the data secret, like all the keys and keys from the use, it
will be stored in the enemy.
So whenever we like, we push this code in some repository in GitHub or other platforms.
Then we don't, we don't, you know, we don't send this and we fight that you can see and get ignored
and not get ignored.
We'll have all the files that we are not we should not pushing, but any repository.
So as you can see, if you can pull off and search for data envy, you can find it.
These are the files that are not.
We will be not hosting or publishing any of it for this file, nor will access to this file, and they
cannot see the secret gift.
Hence, our secret keys safe from the outside users.
OK, so there is a process for this also.
So I'll be telling you, what is it?
First thing is we have to require and configure.
The second thing is create a derby and refine.
The third thing is in the end, we find we have to like now in the filter.
We have that environment specific variables on new lines in the form of name equals to value.
And then if you want to go and check the documentation for examples.
Now we can access our environment variables by using Process Derby and we're actually getting OK now
inside the app.
Or just we can grab the secret value from them.
When one variable creator getting notified inside the file copy and paste the template that comes from
GitHub.
You know all of these things.
Yeah.
So with this, we have completed talking and we.
But.
What if?
But what is a pain point here?
It's probably not that difficult to be able to get our encryption key, even if we saved it in the environment
variable of some somewhere secure in the sunlight.
OK?
They have some mechanisms to fine.
So if they find that if they found the, for example, they had access to your system, their system
is compromised and then they'll get the entity not from the system.
It's where the source code to start, where the server is from the server itself.
So once they get it, like I knew this weekend, I can see all the passwords.
They can hack your accounts and then get hold.
Surveys should be done.
So this is just the basic level two of security.
But if you remember, we have six limits.
So the next step is hashing passwords.
So how to overcome from this pain point, they even though they found out and when, when given everything,
they have access to the server, but they don't know what the actual value is because the values are
hashed.
So how to do that, we'll see in the next week or in the hashing password section.
Thank you.