PEPPER in a backend Flask app throwing KeyError: 'PEPPER'

Question

We are doing a small backend project and the mate who developed the backend is not working with us anymore. We are stuck with this now, I understand this is related to security related? Trying to host the backend on Heroku and we get the below error log.

File "/app/cs673backend/__init__.py", line 9, in <module>
2022-04-20T14:27:01.428446+00:00 app[web.1]: from .api import start_api
2022-04-20T14:27:01.428446+00:00 app[web.1]: File "/app/cs673backend/api/__init__.py", line 1, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: from .authentication  import start as start_authen
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/cs673backend/api/authentication.py", line 10, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: PEPPER = environ["PEPPER"].encode("utf-8")
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/os.py", line 679, in __getitem__
2022-04-20T14:27:01.428447+00:00 app[web.1]: raise KeyError(key) from None
2022-04-20T14:27:01.428448+00:00 app[web.1]: KeyError: 'PEPPER'
2022-04-20T14:27:01.428601+00:00 app[web.1]: [2022-04-20 14:27:01 +0000] [10] [INFO] Worker exiting (pid: 10)
2022-04-20T14:27:01.526847+00:00 app[web.1]: Traceback (most recent call last):
2022-04-20T14:27:01.526854+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 209, in run
2022-04-20T14:27:01.527040+00:00 app[web.1]: self.sleep()
2022-04-20T14:27:01.527042+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 357, in sleep
2022-04-20T14:27:01.527156+00:00 app[web.1]: ready = select.select([self.PIPE[0]], [], [], 1.0)
2022-04-20T14:27:01.527157+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 242, in handle_chld
2022-04-20T14:27:01.527239+00:00 app[web.1]: self.reap_workers()
2022-04-20T14:27:01.527240+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
2022-04-20T14:27:01.527354+00:00 app[web.1]: raise HaltServer(reason, self.WORKER_BOOT_ERROR)
2022-04-20T14:27:01.527399+00:00 app[web.1]: gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>
2022-04-20T14:27:01.527400+00:00 app[web.1]:
2022-04-20T14:27:01.527401+00:00 app[web.1]: During handling of the above exception, another exception occurred:
2022-04-20T14:27:01.527401+00:00 app[web.1]:
2022-04-20T14:27:01.527402+00:00 app[web.1]: Traceback (most recent call last):
2022-04-20T14:27:01.527410+00:00 app[web.1]: File "/app/.heroku/python/bin/gunicorn", line 8, in <module>
2022-04-20T14:27:01.527463+00:00 app[web.1]: sys.exit(run())
2022-04-20T14:27:01.527471+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 67, in run
2022-04-20T14:27:01.527535+00:00 app[web.1]: WSGIApplication("%(prog)s [OPTIONS] [APP_MODULE]").run()
2022-04-20T14:27:01.527542+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/base.py", line 231, in run
2022-04-20T14:27:01.527621+00:00 app[web.1]: super().run()
2022-04-20T14:27:01.527622+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/base.py", line 72, in run
2022-04-20T14:27:01.527681+00:00 app[web.1]: Arbiter(self).run()
2022-04-20T14:27:01.527682+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 229, in run
2022-04-20T14:27:01.527757+00:00 app[web.1]: self.halt(reason=inst.reason, exit_status=inst.exit_status)
2022-04-20T14:27:01.527759+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 342, in halt
2022-04-20T14:27:01.527851+00:00 app[web.1]: self.stop()
2022-04-20T14:27:01.527852+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 393, in stop
2022-04-20T14:27:01.527949+00:00 app[web.1]: time.sleep(0.1)
2022-04-20T14:27:01.527950+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 242, in handle_chld
2022-04-20T14:27:01.528026+00:00 app[web.1]: self.reap_workers()
2022-04-20T14:27:01.528027+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
2022-04-20T14:27:01.528141+00:00 app[web.1]: raise HaltServer(reason, self.WORKER_BOOT_ERROR)
2022-04-20T14:27:01.528167+00:00 app[web.1]: gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>
2022-04-20T14:27:01.691720+00:00 heroku[web.1]: Process exited with status 1
2022-04-20T14:27:01.754717+00:00 heroku[web.1]: State changed from up to crashed
2022-04-20T14:27:27.811162+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/" host=host-py.herokuapp.com request_id=eb24802e-f317-4c41-9f38-8a52371ac736 fwd="117.98.153.124" dyno= connect= service= status=503 bytes= protocol=https
2022-04-20T14:27:28.408186+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/favicon.ico" host=host-py.herokuapp.com request_id=f1532d3b-8c0a-411e-8133-8193e889595a fwd="117.98.153.124" dyno= connect= service= status=503 bytes= protocol=https

Answer 1

The stack trace tells all:

2022-04-20T14:27:01.428446+00:00 app[web.1]: from .api import start_api
2022-04-20T14:27:01.428446+00:00 app[web.1]: File "/app/cs673backend/api/__init__.py", line 1, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: from .  import start as start_authen
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/cs673backend/api/authentication.py", line 10, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: PEPPER = environ["PEPPER"].encode("utf-8")

Here, it appears that on import of api, possibly during processing of __init__.py, there's an import of authentication, and while processing that,

PEPPER = environ["PEPPER"].encode("utf-8")

is encountered. Unfortunately,

2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/os.py", line 679, in __getitem__
2022-04-20T14:27:01.428447+00:00 app[web.1]: raise KeyError(key) from None
2022-04-20T14:27:01.428448+00:00 app[web.1]: KeyError: 'PEPPER'

That environment variable isn't set. Get that set (consult the Heroku docs) and try again.