How to deploy ASP.NET Core UserSecrets to production

Question

I followed the Safe storage of app secrets during development guide over on the asp.net docs during development but it does not describe how to use it when publishing to another machine for QA, Production, etc. What I figured it would do was insert them into the appsettings.json during publish but it does not. I ended up having to place my SendGrid keys and other sensitive information directly into the appsettings.json which really defeats the purpose of the app secrets.

Is using app secrets the best way or is there another way to store API keys and SQL user/passwords in my configs?

I guess you should create it again in every machine you want to run you project for the first time. — Fabricio Koch
– Fabricio Koch, Commented Sep 23, 2016 at 19:52
User secrets are only applied when a certain environmental variable is set to Development — Mitchell Skurnik
– Mitchell Skurnik, Commented Sep 23, 2016 at 20:05
From your link, The Secret Manager tool does not encrypt the stored secrets and should not be treated as a trusted store. It is for development purposes only. This is just to keep secrets from being committed within the code to your repo. In production set the secret values to the appsettings or env variables or any other config source. — Daniel J.G.
– Daniel J.G., Commented Sep 23, 2016 at 20:45
I have the same question. I just don't see the value of User Secrets if in the end you have to end up exposing the values where you store them for production. If it's only useful in development what the hec do you do once you get to production? — Sam
– Sam, Commented Sep 25, 2020 at 13:57
@Sam for production you would usually do value replacement in your build or release pipeline. In azure devops they have places to store production values that get repleased in the release step of your pipeline. — Dblock247
– Dblock247, Commented Feb 19, 2021 at 0:32

blowdart · Accepted Answer · 2016-09-23 20:43:57Z

38

Don't use app secrets in production. Ever. As the article says DURING DEVELOPMENT.

How you publish secrets in production is up to your production environment. Linux, Windows and Azure all support environment variables - that's where your secrets should go, using whatever UI your hosting provider gives you.

The app settings documentation goes into this in greater detail

answered Sep 23, 2016 at 20:43

blowdart

56.8k12 gold badges119 silver badges151 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Mitchell Skurnik Over a year ago

While not as easy as deploying a configuration file I do understand why you would use environmental variables instead.

kgiannakakis Over a year ago

Environmental variables are a very poor source for storing secrets. A local admin has access to them and this is dangerous for many environments. If a Key Vault can be used, the secrets should at least be somehow encrypted.

EKanadily Over a year ago

Environment variable are not more secure that storing values in appsettings.json. a hacker who has access to your file system can access both easily. what is the point of storing values in Environmental variables then?

Ahmed Suror Over a year ago

So what is it useful for in development?! I mean consider that the development machine is mine so what app secrets could do for me?

Lukasz Pomianowski Over a year ago

@AhmedSuror I guess the only advantage I see is that it will help you protect them from accidental committing them into repository.

|

user1855805 · Accepted Answer · 2018-09-21 09:35:20Z

-1

Why "don't use app secrets in production". Is it encrypted secrets safe? It's very acceptable for app configuration, for example, your mentioned SendGrid for password recovery. Is it configuration secrets at all in server? Why do I prohibited? Just copy compiled from development to production and it works.

Startup.cs

    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
        var builder = new ConfigurationBuilder().AddUserSecrets<Startup>();
        Konfiguration = builder.Build();
    }

    public IConfiguration Configuration { get; }

    public IConfiguration Konfiguration { get; }

    public void ConfigureServices(IServiceCollection services)
           ....
        services.AddSingleton<IEmailSender, EmailSender>();
        services.Configure<AuthMessageSenderOptions>(Configuration);
        if (Configuration["SendGridKey"] != null)
            return;
        // linux'e secrets.json nenuskaitomas
        services.Configure<AuthMessageSenderOptions>(options => {
            options.SendGridKey = Konfiguration["SendGridKey"];
            options.SendGridUser = Konfiguration["SendGridUser"];
        });
    }

HomeController.cs

    private readonly IOptions<AuthMessageSenderOptions> _optionsAccessor;

    public HomeController(..., IOptions<AuthMessageSenderOptions> optionsAccessor)
    {
        ...
        _optionsAccessor = optionsAccessor;
    }

    public IActionResult Index(...)
    {
        if (_optionsAccessor.Value.SendGridUser != null)
            ModelState.AddModelError("", _optionsAccessor.Value.SendGridUser);
        ....

Go forward with "Enable account confirmation and password recovery" https://learn.microsoft.com/en-us/aspnet/core/security/authentication/accconfirm?view=aspnetcore-2.1&tabs=visual-studio#configure-email-provider

edited Sep 21, 2018 at 9:35

answered Sep 20, 2018 at 7:31

user1855805

1611 gold badge1 silver badge9 bronze badges

4 Comments

Filnor Over a year ago

A link to a solution is welcome, but please ensure your answer is useful without it: add context around the link so your fellow users will have some idea what it is and why it’s there, then quote the most relevant part of the page you're linking to in case the target page is unavailable. Answers that are little more than a link may be deleted.

Dush Over a year ago

This answer is incorrect and should not follow. "Just copy compiled from development to production and it works" is really dangerous, App Secrets are not encrypted. Read the accepted answer again.

dotnetdevcsharp Over a year ago

this does nothing to answer the users concenrs about encryption in production its a valid point.

Hossein Over a year ago

Warning! The Secret Manager tool doesn't encrypt the stored secrets and shouldn't be treated as a trusted store. It's for development purposes only. The keys and values are stored in a JSON configuration file in the user profile directory. learn.microsoft.com/en-us/aspnet/core/security/…

Collectives™ on Stack Overflow

How to deploy ASP.NET Core UserSecrets to production

2 Answers 2

6 Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related