Security Improvement: Secure Secret Management

[codeCraft-Ritik]

Issue :

The project uses a base.py settings file that defaults certain security settings or relies on environment variables that might not be set, which can lead to vulnerabilities if misconfigured in production.

Recommendation : Implement a check to ensure SECRET_KEY and other sensitive variables are never defaulted to insecure values in a production environment.

File Path : pytogether/backend/backend/settings/prod.py

Suggested Code :

import os
from .base import *

# Ensure the secret key is provided by the environment
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
if not SECRET_KEY:
    raise ValueError("The DJANGO_SECRET_KEY environment variable is not set.")

DEBUG = False
ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')