Use env vars instead of config files.

[jkrilov]

There should be a way to pull the AAD config from env vars. Storing your client secret in a json alongside your code is a really bad practice. I'm not sure why it's being suggested as a production solution.

[rayluo]

Storing your client secret in a json alongside your code is a really bad practice.

If you were talking about this ms-identity-python-webapp repo, it is already reading sensitive configuration (and client secret in particular) from env var. If you were talking about some other repo, feel free to close this discussion, and create a new one in the corresponding repo, so that we will address it there.

[jkrilov]

Storing your client secret in a json alongside your code is a really bad practice.

If you were talking about this ms-identity-python-webapp repo, it is already reading sensitive configuration (and client secret in particular) from env var. If you were talking about some other repo, feel free to close this discussion, and create a new one in the corresponding repo, so that we will address it there.

This one: https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/1-Authentication/sign-in

And this one: https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/1-Authentication/sign-in-b2c

I guess the discussion is per org. I'll open an issue under that repo.

[rayluo]

Thanks. You can tag me in your new issues. Meanwhile, I'm closing this one.