App Service - PY tutorial - secret leak fix

Author: v-geberr

articles/app-service/media/tutorial-python-postgresql-app/azure-portal-app-service-app-setting-save.png

@@ -154,7 +154,7 @@ Sign in to the [Azure portal](https://portal.azure.com/) and follow these steps
 
 ## 2. Verify connection settings
 
-The creation wizard generated the connectivity variables for you already as [app settings](configure-common.md#configure-app-settings).
+The creation wizard generated the connectivity variables for you already as [app settings](configure-common.md#configure-app-settings). App settings are one way to keep connection secrets out of your code repository. When you're ready to move your secrets to a more secure location, here's an [article on storing in Azure Key Vault](../key-vault/certificates/quick-create-python.md).
 
 :::row:::
     :::column span="2":::
@@ -167,14 +167,33 @@ The creation wizard generated the connectivity variables for you already as [app
 :::row:::
     :::column span="2":::
         **Step 2.** In the **Application settings** tab of the **Configuration** page, verify that `AZURE_POSTGRESQL_CONNECTIONSTRING` is present. That will be injected into the runtime environment as an environment variable.
-        App settings are one way to keep connection secrets out of your code repository. 
-        When you're ready to move your secrets to a more secure location,
-        here's an [article on storing in Azure Key Vault](../key-vault/certificates/quick-create-python.md).
     :::column-end:::
     :::column:::
         :::image type="content" source="./media/tutorial-python-postgresql-app/azure-portal-get-connection-string-2.png" alt-text="A screenshot showing how to see the autogenerated connection string." lightbox="./media/tutorial-python-postgresql-app/azure-portal-get-connection-string-2.png":::
     :::column-end:::
+:::row:::
+    :::column span="2":::
+        **Step 3.** In a terminal or command prompt, run the following Python script to generate a unique secret: `python -c 'import secrets; print(secrets.token_hex())'`. Copy the output value to use in the next step.
+    :::column-end:::
+    :::column:::
+    :::column-end:::
 :::row-end:::
+:::row:::
+    :::column span="2":::
+        **Step 4.** In the **Application settings** tab of the **Configuration** page, select **New application setting**. Name the setting `SECRET_KEY`. Paste the value from the previous value. Select **OK**.
+    :::column-end:::
+    :::column:::
+        :::image type="content" source="./media/tutorial-python-postgresql-app/azure-portal-app-service-app-setting.png" alt-text="A screenshot showing how to set the SECRET_KEY app setting in the Azure portal." lightbox="./media/tutorial-python-postgresql-app/azure-portal-app-service-app-setting.png":::
+    :::column-end:::
+:::row:::
+    :::column span="2":::
+        **Step 5.** Select **Save**.
+    :::column-end:::
+    :::column:::
+        :::image type="content" source="./media/tutorial-python-postgresql-app/azure-portal-app-service-app-setting-save.png" alt-text="A screenshot showing how to save the SECRET_KEY app setting in the Azure portal." lightbox="./media/tutorial-python-postgresql-app/azure-portal-app-service-app-setting-save.png":::
+    :::column-end:::
+:::row-end:::
+
 
 Having issues? Check the [Troubleshooting guide](configure-language-python.md#troubleshooting).