Hide Firebase secrets on Heroku and NodeJS

Yoshevski
3 min readDec 1, 2020

Setting new project on Firebase it is easy, same applies on Heroku, but it is important to keep your credentials on a secret place and avoid to be compromised.

It important that JSON file or JS object that you will issue from Firebase are kept outside your project folder and not being a part of a git repository.
*sending files within git, might get compromised if your repository becomes public or there is a breach on the git server

Taking care of this security part will also help you to have multi-environment variables for Firebase which you can use from your local machine or from different instances on Heroku.

So what you need to do:
*assuming that you have placed files outside your work (project) directory

Create a setup script that will be used for local purposes to switch between environments.

Example of setup file, and expected files

Update your package.json file with scrips for each environment

This setup will allow you to create many different environments and use different Firebase project for each environment.

If you want to re-use same project, just remove the ${process.env.ENVIRONMENT} part of the code above.

Make sure you import setup.js file in your nodejs main file (server.js) at its first line.
Once you run the npm command, files will be open/read and all values from it will be stored to process.env variable which is available across all nodejs files.

If you need to access to some of the values related to Firebase (or any stored in process.env) just type process.env.NAME_OF_PROPERTY to get its value.

example: const apiKey = process.env.apiKey
you can also use object destructing to get values.

It is important furthermore that your project is using values stored in process.env for Firebase and other config related things.

Once you are done with this, and test it to work locally, it is time to make further updates on Heroku.

Go to your dashboard on Heroku, open the app (preferable to have pipeline with multiple environments of the app).

Then open the settings tab and click on reveal config vars button and there add the same properties with its values from the mentioned files above (one by one). Don’t forget to add ENVIRONMENT as variable as well and set its value to correspond to the environment you are using on Heroku.

Now when you open your application on Heroku it will auto use the values from Firebase for the proper environment, while also keep your secrets safe and being able to switch between different environments very easily.

Thanks for reading,
More from me: https://medium.com/@yoshevski

--

--

Yoshevski

Long time in the IT field as fullstack developer.