Problem
Securely store the configuration settings without exposing them to the source control in ASP.NET Core.
Solution
Create an empty project and right-click on the Project Solution. Click “Manager User Secrets”:
This will open the secrets.json file. Add a setting name/value pair.
- {
- "SecretSetting": "SecretValue"
- }
Add a POCO for these application settings.
- public class AppSettings
- {
- public string SecretSetting { get; set; }
- }
Then, inject the configuration settings in the constructor for Startup class.
- public static IConfiguration Config { get; private set; }
-
- public Startup(
- IConfiguration config)
- {
- Config = config;
- }
Then, add option services to the ConfigureServices() method of Startup class.
- public void ConfigureServices(
- IServiceCollection services)
- {
- services.AddOptions();
- services.Configure<AppSettings>(Config);
- }
Next, inject settings as IOptions<T> interface, where T is your POCO for Settings.
- public static class UseMiddlewareExtensions
- {
- public static IApplicationBuilder UseHelloWorld(this IApplicationBuilder app)
- {
- return app.UseMiddleware<HelloWorldMiddleware>();
- }
- }
-
- public class HelloWorldMiddleware
- {
- private readonly RequestDelegate next;
- private readonly AppSettings settings;
-
- public HelloWorldMiddleware(
- RequestDelegate next,
- IOptions<AppSettings> options)
- {
- this.next = next;
- this.settings = options.Value;
- }
-
- public async Task Invoke(HttpContext context)
- {
- var jsonSettings = JsonConvert.SerializeObject(this.settings);
- await context.Response.WriteAsync(jsonSettings);
- }
- }
Setup the middle in Configure() method of the Startup class.
- public void Configure(
- IApplicationBuilder app,
- IHostingEnvironment env)
- {
- app.UseHelloWorld();
- }
Running the sample application will give you the following output.
Discussion
I discussed in the previous post how configuration settings can be stored in configuration files. However, these files are checked in the source control and are not suitable to store confidential settings. In a production environment, these settings can be stored in environment variables or Azure Key Vault, however, for development, ASP.NET Core provides an alternate solution: Secret Manager.
Secret Manager lets developers store the configuration settings in secrets.json file which isn’t checked-in the source control. The secrets.json file is stored in AppData folder and you could see the exact path by hovering your mouse over the file tab in VS 2017. An important point to note here is that the settings are stored in plain text. This file is read by the runtime when loading configuration during building the WebHost, as discussed here.
CLI
You could also use the CLI command dotnet user-secrets to manage the secret settings. In order to do that, first add the following to .csproj,
- <ItemGroup>
- <DotNetCliToolReference Include="Microsoft.Extensions.SecretManager.Tools" Version="2.0.0" />
- </ItemGroup>
Now, you could use the following commands to manage the secrets.
Command |
Description |
Example |
list |
List all the secrets |
dotnet user-secrets list |
set |
Add/update user secret |
dotnet user-secrets set SecretSetting “SecretValue” |
remove |
Removes a secret |
dotnet user-secrets remove SecretSetting |
clear |
Remove all secrets |
dotnet user-secrets clear |
Source Code
GitHub