Django dev server request.META has all my env vars

I just ran into this as well which caught me by surprise, I thought my page was sending all my env variables to the server. I use the env to store credentials so I was concerned.

Any application running in your environment has access to your env variables, therefore the server has access to your env variables. Bottom line the browser is not sending all your env variables to the server. The request object is built on the server side.

The request is constructed by the web server. By using the Django development environment, you are presumably using the Werkzeug web server.

That's why the request has options from the process environment, because that's how Werkzeug constructs a request.