How to properly protect the authorization token when posting a Discord Bot to Heroku?
Clash Royale CLAN TAG#URR8PPP
How to properly protect the authorization token when posting a Discord Bot to Heroku?
I own a discord server with about ~5000 people and simultaneously run a bot on it.
Until now, the bot got hacked two times in a row, and afterwards sent out troll messages (luckily nothing more because I restricted the bot's rights) because I simply forgot to hide the authorization token in the GitHub repository - the bot authorization token was hardcoded in the bot script and thus publicly available to view.
The problem is, I am really not familiar with coding... so in order to avoid that problem, I simply deployed the original GitHub repository to Heroku, and after that deleted the whole repository on GitHub. Which means that the bot commit is only privately hosted by Heroku now, and is not publicly viewable on GitHub any more. The bot is running perfectly though, at the moment.
Even though I now would have to create a new repository each time I want to update the bot, it would be no problem for me as long as this current solution is secure. But I am not sure if it really is, because I am fearing that hackers could still scrape the token because it is still hardcoded in the bot script, even if it’s not publicly viewable on GitHub any more.
I tried to figure out how to add an .env to the bot commit but couldn’t manage it because all instructions and tutorials were somehow Java only and not for Python. The bot script though, is really simple:
import discord
from discord.ext import commands
bot = commands.Bot(command_prefix='$')
bot.remove_command("help")
@bot.event
async def on_ready():
print('Logged in as')
print(bot.user.name)
print(bot.user.id)
print('------')
*[several commands]*
bot.run('The Token')
This is the bot commit which is currently hosted on Heroku, with the token hardcoded in the bot script, but not publicly viewable on GitHub any more. I simply do not know what to add in my script/ change in my Heroku account in order to create an .env with authorizing the Bot Token on Heroku itself rather than having it in the bot script.
(As an aside: your server didn't get hacked. "Hacking" is the clever art of finding backdoors and tricks to get into a system without sufficient authorisation, but in this case, you effectively gave someone the key).
– halfer
Aug 13 at 10:34
Also, don't forget to invalidate/delete the compromised token and create a new one for your live instance.
– halfer
Aug 13 at 10:38
Just to correct halfers statement: hacking is rather sort of like, finding vulnerabilities to gain privileges on destination app/system/whatever, then once you have access might place backdoors to be able to get back in later...
– kayess
Aug 13 at 10:39
So this would be the right way to do it? pastebin.com/6UPvzWSd
– Patch
Aug 13 at 10:58
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
For the time being, you could get a free account on BitBucket and host your code privately. A better solution is to set up an environment variable on your server with the auth token, and then read it in your Python code. (I would encourage you to search for that, and give it a try on a test copy, rather than replying to ask "how to do that").
– halfer
Aug 13 at 10:33