Hardcoded API Keys in JavaScript/Node.js Applications

// config/production.js - SECURE production configuration
const requiredConfig = [
  'DB_HOST', 'DB_PORT', 'DB_NAME', 'DB_USERNAME', 'DB_PASSWORD',
  'REDIS_HOST', 'REDIS_PORT', 'REDIS_PASSWORD',
  'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_REGION',
  'SENDGRID_API_KEY', 'SLACK_WEBHOOK_URL',
  'JWT_SECRET', 'ENCRYPTION_KEY'
];

// Validate all required environment variables are present
const missingConfig = requiredConfig.filter(key => !process.env[key]);
if (missingConfig.length > 0) {
  console.error('Missing required environment variables:', missingConfig);
  process.exit(1);
}

module.exports = {
  database: {
    host: process.env.DB_HOST,
    port: parseInt(process.env.DB_PORT),
    name: process.env.DB_NAME,
    username: process.env.DB_USERNAME,
    password: process.env.DB_PASSWORD
  },
  
  redis: {
    host: process.env.REDIS_HOST,
    port: parseInt(process.env.REDIS_PORT),
    password: process.env.REDIS_PASSWORD
  },

  external: {
    aws: {
      accessKeyId: process.env.AWS_ACCESS_KEY_ID,
      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
      region: process.env.AWS_REGION
    },
    
    sendgrid: {
      apiKey: process.env.SENDGRID_API_KEY
    },
    
    slack: {
      webhookUrl: process.env.SLACK_WEBHOOK_URL
    }
  },

  security: {
    jwtSecret: process.env.JWT_SECRET,
    encryptionKey: process.env.ENCRYPTION_KEY
  }
};

// Optional: Add configuration validation
function validateConfiguration(config) {
  // Validate JWT secret length
  if (config.security.jwtSecret.length < 32) {
    throw new Error('JWT secret must be at least 32 characters long');
  }
  
  // Validate encryption key length
  if (config.security.encryptionKey.length !== 32) {
    throw new Error('Encryption key must be exactly 32 characters long');
  }
  
  return config;
}

module.exports = validateConfiguration(module.exports);

// webpack.config.js - SECURE: Only client-safe variables exposed
const webpack = require('webpack');

// Define which environment variables are safe for client-side
const clientSafeEnvVars = {
  'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV),
  'process.env.API_URL': JSON.stringify(process.env.API_URL),
  'process.env.GOOGLE_MAPS_API_KEY': JSON.stringify(process.env.GOOGLE_MAPS_API_KEY),
  'process.env.SENTRY_DSN': JSON.stringify(process.env.SENTRY_DSN),
  'process.env.APP_VERSION': JSON.stringify(process.env.APP_VERSION)
};

module.exports = {
  // ... other webpack config
  plugins: [
    new webpack.DefinePlugin(clientSafeEnvVars)
  ]
};

// src/api/client.js - SECURE: Proper client-side API handling
class ApiClient {
  constructor() {
    this.baseURL = process.env.API_URL;
    this.timeout = 10000;
    
    // No secrets stored on client-side
    this.headers = {
      'Content-Type': 'application/json'
    };
  }
  
  // Secure: Token verification happens on server
  async authenticateUser(credentials) {
    const response = await fetch(`${this.baseURL}/auth/login`, {
      method: 'POST',
      headers: this.headers,
      body: JSON.stringify(credentials)
    });
    
    if (response.ok) {
      const { token } = await response.json();
      // Store token securely (httpOnly cookie is better)
      localStorage.setItem('authToken', token);
      return token;
    }
    throw new Error('Authentication failed');
  }
  
  // Include auth token in requests
  async makeAuthenticatedRequest(endpoint, options = {}) {
    const token = localStorage.getItem('authToken');
    const headers = {
      ...this.headers,
      ...(token && { Authorization: `Bearer ${token}` }),
      ...options.headers
    };
    
    return fetch(`${this.baseURL}${endpoint}`, {
      ...options,
      headers
    });
  }
}

// Server-side token verification (separate file: server/auth.js)
// const jwt = require('jsonwebtoken');
// 
// function verifyToken(token) {
//   return jwt.verify(token, process.env.JWT_SECRET); // Secret stays on server
// }