Skip to main content

.NET Core - (User) Secrets Exposed!

Managing credentials is hard. Developers try to keep development credentials separate from Production ones by using weird pre-processor directives or convoluted if...else statements. If you have ever worked with a development team, you know these quickly go out of hand. You might also have used environment variables to define configuration such as a database connection string. These work great but still cause some issue when moving between Windows and Linux OSes. For example, Bash does not like the : based hierarchical structure defined by .NET Core. So you have to replace the : with __ (double underscores). Environment variables are also harder to manage unless you are using a third party tool.

Fortunately, .NET Core 3.0 onward now ships with a built-in Secret Manager. These are called User Secrets and are stored on a per-user (duh!) basis typically at this path %APPDATA%\Microsoft\UserSecrets\<user_secrets_id>\secrets.json. We need not worry about the location of this file as all this is abstracted away from the user.

To enable user secrets on a project, run the following command while present in the same directory where .csproj is present:
dotnet user-secrets init
This adds a UserSecretsId element within a PropertyGroup of the .csproj file. By default, the inner text of UserSecretsId is a GUID. The inner text is arbitrary, but is unique to the project.

Next create a secret in a key/value combination. For example,
dotnet user-secrets set "ConnectionStrings:AppConfig" "MyConnString"
This user secret source is automatically inserted when CreateDefaultBuilder method is called and environment is Development.

To use this secret, you just have to call the Configuration indexer as you would call normally.
public void ConfigureServices(IServiceCollection services)
{ 
    _appConfig = Configuration["ConnectionStrings:AppConfig"]; 
}
To remove a secret or clear all secrets or list the secrets, use the corresponding remove, clear or list commands. If you are using Visual Studio, you can use the “Manage User Secrets” context menu to manage the secrets.

Note that user secrets does not replace any other means of inserting settings in your .NET application. You can still use them together just mindful of the fact that the order in which these settings are loaded defines overriding works.
builder.ConfigureAppConfiguration((hostingContext, config) => 
{ 
   ... 
   config.AddJsonFile("appsettings.json", optional: true, reloadOnChange: true) 

   // Added before AddUserSecrets to let user secrets override 
   // environment variables. 
   config.AddEnvironmentVariables(); 
}
User Secrets are a great addition to the .NET Core toolbox. They provide a standardized way of managing development secrets without the need to write any extra code or convoluted logic.

Comments

Popular posts from this blog

Centralized Configuration for .NET Core using Azure Cosmos DB and Narad

We are living in a micro services world. All these services are generally hosted in Docker container which are ephemeral. Moreover these service need to start themselves up, talk to each other, etc. All this needs configuration and there are many commercially available configuration providers like Spring Cloud Config Server, Consul etc. These are excellent tools which provide a lot more functionality than just storing configuration data. However all these have a weakness - they have a single point of failure - their storage mechanism be it a file system, database etc. There are ways to work around those but if you want a really simple place to store configuration values and at the same time make it highly available, with guaranteed global availability and millisecond reads, what can be a better tool than Azure Cosmos DB!
So I set forth on this journey for ASP.NET Core projects to talk to Cosmos DB to retrieve their configuration data. For inspiration I looked at Steeltoe Configuratio…

Proud to be a Bihari?

After nearly an year, this December I had a chance to visit Bihar. My visits normally consist of resting in my home in Patna and occasional visits to my uncle's place. But this time it was different. I had to go to Gaya to attend my cousin sister's marriage ceremony. Stepping out of Patna made me question - Am I really proud to be a Bihari?

Patna is like any other city in India, struggling with pollution, traffic jams, crime, etc. Being snuggled in my bed in Patna had made me forget the reality of what Bihar really is; after all its been nearly 10 years since I had traveled to any town outside of Patna in Bihar. So, the illusion was broken the moment my uncle's brand new Maruti A-Star moved out of outskirts of Patna, to what is supposedly the "National Highway". If you haven't guessed it already, its an apology of a road.

Ajab Prem Ki Not So Ghazab Kahani!!

As I had written earlier I was in the process of shifting my home to somewhere near my office. Finally, I managed to do it and was peacefully nestled in my new home. Everything was going at its normal pace (meaning boring), till yesterday while in office, I received a call from my new roommate asking whether I wanted to watch "Ajab Prem Ki Ghazab Kahani". I couldn't remember the name of the last movie that I had seen in a theater, so I figured that may be its time to watch a movie. Also, the title and promos of the movie looked interesting. Plus, people comparing it to "Andaz Apna Apna", (directed by the same man who has directed this - Rajkumar Santoshi) finally pushed me over the edge.

We went to E-Square, Pimpri for the 9.45PM show with high expectations. The movie begins in a fictional town by the name "Wellington" (which is basically Ooty where the movie was primarily shot). A reporter enters into an empty town, and wonders where the people had go…