Environment Variables Security
The cluster discusses the security risks, best practices, and drawbacks of using environment variables in programming, including mutability issues with setenv/getenv, recommendations for read-only access or config files, and debates on their appropriateness versus alternatives.
Activity Over Time
Top Contributors
Keywords
Sample Comments
How are environment variables insecure?
Environment variables are not the problem. It's environment variables with too much power and the possibility to change them remotely.
Env vars are good if you treat them as read-only within the process
Abusing? I thought this is exactly what envvars are for.
You do know about environmental variables?
It's not just libc, it's any C or C++ library that calls getenv or setenv.
How would this be an improvement over setting environment variables?
Isn't it bad? Given that only admin/power user can change environment variable, this will be a issue in shared hosting right?
Yeah, it’s easy until someone calls setenv ;)
You could make a PR, it looks like the language doesn’t have environment variable access!