Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and loads them in as runtime variables to the Node.js app.
Neither file (the .env or the config.json) are added to git for obvious reasons.
My question. From a security perspective which is the better method?
- .env files should be faster to load that the .json (no json parse)
- from what i can gather the config.json keys are stored in global Node variables
- both can be overwritten at runtime if required
- the type of data stored in each var can be as broad as salts, server configs, numbers, paths etc etc. Basically any info the Node app will need to run.