Application secret from env variable does not work

[cornim]

The documentation states

play.http.secret.key="changeme"
play.http.secret.key=${?APPLICATION_SECRET}

The second line in that configuration sets the secret to come from an environment variable called APPLICATION_SECRET if such an environment variable is set, otherwise, it leaves the secret unchanged from the previous line.

But if this is set in the application.conf an exception is thrown, complaining that the entropy of the secret is too low pointing to the second line, even if there is no such environment variable set.
This is also the case if the first line contains a secret with sufficient entropy.

Play Version

3.0.2

API

Scala 3.3.1

Operating System

22.04.1-Ubuntu

JDK

openjdk version "17.0.10" 2024-01-16
OpenJDK Runtime Environment (build 17.0.10+7-Ubuntu-122.04.1)
OpenJDK 64-Bit Server VM (build 17.0.10+7-Ubuntu-122.04.1, mixed mode, sharing)

Expected Behavior

The secret from the first line (play.http.secret.key=<actual secret with sufficient entropy>) in the config should be used.

Actual Behavior

The second line (play.http.secret.key=${?APPLICATION_SECRET}) is used resulting in a secret with insuffcient entropy.

Commenting out the second line makes the applicaton work.
And I checked the relevant environment variables with sbt show run / envVars and the returned map was empty.

[mkurz]

And I checked the relevant environment variables with sbt show run / envVars and the returned map was empty.

This is expected behaviour, see my explanation in #10972 (comment). Maybe you misunderstood what envVars is used for.

Anyway, you say that when you remove the (second) line play.http.secret.key=${?APPLICATION_SECRET} from your config, then your application is working. Seems like you do have a APPLICATION_SECRET environment variable defined somehow, somewhere (maybe /etc/environment? Or in one of the .bash* files in the home directory?). Can you please check what env | grep -i APPLICATION_SECRET on the used Ubuntu machine outputs?

[cornelius-mund]

I found the issue.

APPLICATION_SECRET was not set but there was a strange character in that line after the variable that apparantly caused the issue. (see diff below)

Thanks for your quick response anyway.

-play.http.secret.key=${?APPLICATION_SECRET}
+play.http.secret.key=${?APPLICATION_SECRET}

[mkurz]

Perfect, glad you found the problem!

Thanks for your quick response anyway.

You are welcome! Have a nice time coding with Play 😉