Use password from environment

config/config.exs

@@ -11,6 +11,8 @@ config :music_library,
   ecto_repos: [MusicLibrary.Repo],
   generators: [timestamp_type: :utc_datetime, binary_id: true]
 
+config :music_library, MusicLibraryWeb, auth_password: "change me"
+
 # Configures the endpoint
 config :music_library, MusicLibraryWeb.Endpoint,
   url: [host: "localhost"],

config/runtime.exs

@@ -44,9 +44,17 @@ if config_env() == :prod do
       You can generate one by calling: mix phx.gen.secret
       """
 
+  auth_password =
+    System.get_env("AUTH_PASSWORD") ||
+      raise """
+      environment variable AUTH_PASSWORD is missing.
+      """
+
   host = System.get_env("PHX_HOST") || "example.com"
   port = String.to_integer(System.get_env("PORT") || "4000")
 
+  config :music_library, MusicLibraryWeb, auth_password: auth_password
+
   config :music_library, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 
   config :music_library, MusicLibraryWeb.Endpoint,

lib/music_library_web/controllers/session_controller.ex

@@ -7,10 +7,8 @@ defmodule MusicLibraryWeb.SessionController do
     conn |> render(:new, form: @empty_form, layout: {MusicLibraryWeb.Layouts, "unauthenticated"})
   end
 
-  def create(conn, params) do
+  def create(conn, %{"password" => request_password}) do
-    password = params["password"]
+    if Plug.Crypto.secure_compare(password(), request_password) do
-
-    if password == "password" do
       conn
       |> put_session(:logged_in, true)
       |> redirect(to: "/")
@@ -20,4 +18,9 @@ defmodule MusicLibraryWeb.SessionController do
       |> redirect(to: ~p"/login")
     end
   end
+
+  def password do
+    Application.get_env(:music_library, MusicLibraryWeb)
+    |> Keyword.fetch!(:auth_password)
+  end
 end