Add .env for SECRET in authentication

Hello,

When authentication is set up via feathers CLI, the secret is exposed in the file default.json. People who are used to working with authentication will not have any trouble creating a .env file, but I think it would be nicer and more secure to have a default .env containing the automatically generated secret. Obviously this implies some change, such as switching from default.json to default.js in config and installing dotenv.

Tell me what you think !

Thank,

[spidgorny]

For those who want to keep using .env (industry standard): adding these two lines in the beginning of src/index.ts works as expected.

import dotenv from 'dotenv';
dotenv.config();

Test with

console.log(app.get('authentication').oauth.twitter);

[daffl]

Can you explain a little more what the win would be? From what I understand .env is supposed to separate your configuration from you code but isn’t that the same as having it in those .json configuration files (which can also load from environment variables). Right now we can use local-<env>.json via node-config for environment settings we don’t want to check in.