dotenv-webpack
Advanced tools
Package description
The dotenv-webpack npm package is a plugin for webpack that automates the loading of environment variables from a .env file into process.env, providing an easy way to configure your application's environment-specific variables. It wraps dotenv and Webpack.DefinePlugin under the hood.
Load environment variables
Automatically loads environment variables from a .env file and makes them available in your application through process.env.
const Dotenv = require('dotenv-webpack');
module.exports = {
//... other webpack config
plugins: [
new Dotenv()
]
//... other webpack config
};Custom .env file path
Allows you to specify a custom path to your .env file if it's not located in the root directory.
const Dotenv = require('dotenv-webpack');
module.exports = {
//... other webpack config
plugins: [
new Dotenv({
path: './some/other/path/.env'
})
]
//... other webpack config
};Safe mode
Enables safe mode to ensure that all necessary environment variables are defined, by comparing with a template file (usually .env.example).
const Dotenv = require('dotenv-webpack');
module.exports = {
//... other webpack config
plugins: [
new Dotenv({
safe: true // load '.env.example' to check all necessary variables are defined
})
]
//... other webpack config
};System variables
Allows the inclusion of system environment variables in the webpack build in addition to the variables from the .env file.
const Dotenv = require('dotenv-webpack');
module.exports = {
//... other webpack config
plugins: [
new Dotenv({
systemvars: true // load all system environment variables in addition to .env file
})
]
//... other webpack config
};The EnvironmentPlugin is a built-in webpack plugin that can define environment variables similar to dotenv-webpack. However, it does not read from a .env file by default and requires manual definition of variables.
The DefinePlugin is another built-in webpack plugin that allows you to create global constants which can be configured at compile time. It's more manual and less focused on environment variables compared to dotenv-webpack.
env-cmd is a simple node program for executing commands using an environment from an env file. It's not a webpack plugin but can be used in conjunction with npm scripts to achieve similar results.
cross-env allows you to set and use environment variables across platforms without worrying about platform-specific issues. It's not a webpack plugin but can be used in npm scripts to manage environment variables.
Readme
A secure webpack plugin that supports dotenv and other environment variables and only exposes what you choose and use.
dotenv-webpack
Include the package locally in your repository.
npm install dotenv-webpack --save-dev
dotenv-webpack wraps dotenv and Webpack.DefinePlugin. As such, it does a text replace in the resulting bundle for any instances of process.env.
Your .env files can include sensitive information. Because of this,dotenv-webpack will only expose environment variables that are explicitly referenced in your code to your final bundle.
The plugin can be installed with little-to-no configuration needed. Once installed, you can access the variables within your code using process.env as you would with dotenv.
The example bellow shows a standard use-case.
// .env
DB_HOST=127.0.0.1
DB_PASS=foobar
S3_API=mysecretkey
// webpack.config.js
const Dotenv = require('dotenv-webpack');
module.exports = {
...
plugins: [
new Dotenv()
]
...
};
// file1.js
console.log(process.env.DB_HOST);
// '127.0.0.1'
// bundle.js
console.log('127.0.0.1');
Note: the .env values for DB_PASS and S3_API are NOT present in our bundle, as they were never referenced (as process.env.[VAR_NAME]) in the code.
By allowing you to define exactly where you are loading environment variables from and bundling only variables in your project that are explicitly referenced in your code, you can be sure that only what you need is included and you do not accidentally leak anything sensitive.
Add .env to your .gitignore file
Use the following properties to configure your instance.
'./.env') - The path to your environment variables.false) - If true, load '.env.example' to verify the '.env' variables are all set. Can also be a string to a different file.false) - Whether to allow empty strings in safe mode. If false, will throw an error if any env variables are empty (but only if safe mode is enabled).false) - Set to true if you would rather load all system variables as well (useful for CI purposes).false) - If true, all warnings will be suppressed.false) - Allows your variables to be "expanded" for reusability within your .env file.false) - Adds support for dotenv-defaults. If set to true, uses ./.env.defaults. If a string, uses that location for a defaults file. Read more at https://www.npmjs.com/package/dotenv-defaults.The following example shows how to set any/all arguments.
module.exports = {
...
plugins: [
new Dotenv({
path: './some.other.env', // load this now instead of the ones in '.env'
safe: true, // load '.env.example' to verify the '.env' variables are all set. Can also be a string to a different file.
allowEmptyValues: true, // allow empty variables (e.g. `FOO=`) (treat it as empty string, rather than missing)
systemvars: true, // load all the predefined 'process.env' variables which will trump anything local per dotenv specs.
silent: true, // hide any errors
defaults: false // load '.env.defaults' as the default values if empty.
})
]
...
};
MIT
FAQs
A simple webpack plugin to support dotenv.
The npm package dotenv-webpack receives a total of 650,839 weekly downloads. As such, dotenv-webpack popularity was classified as popular.
We found that dotenv-webpack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The US Justice Department has penalized two consulting firms $11.3 million for failing to meet cybersecurity requirements on federally funded projects, emphasizing strict enforcement to protect sensitive government data.
Security News
ua-parser-js is set to drop the MIT license and adopt a controversial dual AGPLv3 + PRO licensing model in its upcoming v2.0 release, raising significant concerns among developers and enterprise users.
Security News
Researchers recently demonstrated that the npm Registry is vulnerable to cache poisoning combined with DoS, posing significant risks for package availability.