This is the fifth of a new series of posts on ASP .NET Core. This week, we’ll be looking at app secrets for ASP .NET Core projects, for use in development environments.
Protecting Application Secrets During Development
Most web apps need to store some configuration information that can be accessed by the application during runtime. This may include database connection strings and API keys, which are not user-specific confidential values, but are still sensitive pieces of information that need to be protected.
Once in a while, a developer may accidentally commit such sensitive information to public repositories such as Github. Quoting this blog post from the Azure website, “Keep in mind that removing a published secret does not address the risk of exposure. The secret may have been compromised, with or without your knowledge and is still exposed in Git History. For these reasons, the secret must be rotated and/or revoked immediately to avoid security risks.”
This blog post intends to prevent you from ever making that mistake in the first place. You may download the following sample project to follow along.
AppSecretDemo: https://github.com/shahedc/AppSecretDemo
