Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add environment variables to context #100

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

kx-chen
Copy link
Contributor

@kx-chen kx-chen commented Dec 6, 2018

Add environment variables to context so they
may be used in views.

Closes #72

Alternatively, instead of passing all env variables in, I think statik could use an environment variable (maybe STATIK_ENV?) to determine the environment its running in, and only pass that variable to the context.

Add environment variables to context so they
may be used in views.

Closes thanethomson#72
@jayvdb
Copy link
Collaborator

jayvdb commented Dec 9, 2018

I think it is necessary that the caller can prevent access to all environment variables, which may contain secrets.

A cmdline flag turning on this feature?

A cmdline flag listing the env vars which are allowed to be accessed?

A prefix, so only a subset of env vars are visible inside statik? i.e. STATIK_ENV allows only STATIK_ENV_FOO to be seen. This is the 'safest' in a netlify context, as a PR might modify netlify.toml and alter command line variables.

But worth keeping in mind everything is insecure in netlify deploy previews, as the requirements.txt could be changed to refer to a fork of statik, which allows any code modifications to bypass restrictions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants