Connect to the database in a Heroku node.js app without revealing authentication details on git

Question

I have a node.js app that I pushed to Heroku. It uses MongoDB for it's storage. Heroku offers a free MongoDB as an addon that your app can connect to. Now my question is, since the connection string is of this format: mongodb://dbuser:dbpass@host:port/dbname, and since Heroku uses git to push, how do I push my code to a public GitHub repo without revealing my username and password to everyone?

Is there no way to make the database open but only to connections coming from my Heroku app?

I have to admit I'm pretty confused on the whole matter.

Answer 1

You will want to read over Configuration and config vars in the Heroku dev center. Heroku expects and encourages you to use config variables (configured on the Heroku app itself and not in the codebase) to protected sensitive data like passwords. Use heroku config:set VARIABLE=value, but do note that most Heroku addons, when provisioned, automatically add authentication information to your config variables. You can check out what has been set with the heroku config command.

Using node, you would access your environment variables with process.ENV.VARIABLE, where VARIABLE is the name of the environment/config variable you're trying to access.

As a final note, you can add local environment variables to .env in your project directory (add the file to .gitignore!)... foreman will load these when you use foreman start or foreman run.

Answer 2

if you run:

    heroku config

the toolbelt will show the env variables, that way you can use the env variable inside your code:

    process.env.VARIABLE