Quiz
Warm-up from lesson 7-4. Why must the JWT signing secret never be a const in a file committed to git?
One codebase, many environments
The same code runs on your laptop, on a test server, and in production, but with different ports, database URLs, and secrets. Hardcoding any of them breaks the others.
The convention: configuration comes from environment variables, the key-value pairs every process receives from its parent (lesson 2-3 introduced process.env).
PORT=4000 JWT_SECRET=k3... node server.jsconst port = Number(process.env.PORT || 3000);
Locally, a .env file (loaded by the dotenv package or node --env-file) holds these, and .env goes in .gitignore, the list of paths git is told never to record (lesson 7-4 explained why a secret that reaches git history is unrecoverable). In production, your hosting platform injects them.
Two habits separate clean config from chaos: defaults for harmless settings (port, log level), and fail fast at startup for required secrets, because a server that boots without its JWT secret will only reveal the problem when logins mysteriously fail at 2 a.m.
Code exercise · javascript
Your turn. Complete loadConfig(env). If JWT_SECRET is missing, return { ok: false, error: "missing required config: JWT_SECRET" }. Otherwise return ok with port (Number, default 3000), logLevel (default "info"), and jwtSecret.
Code exercise · javascript
Your turn. The core of the dotenv package is a small parser. Implement parseEnvFile(text): one KEY=VALUE per line, skip empty lines and lines starting with # (comments), and split at the FIRST = only, so values may themselves contain = signs (the first-separator trick from lesson 1-3's header parser).
Quiz
Why should a missing JWT_SECRET stop the server at STARTUP instead of being handled when the first login request needs it?