Coding Shorts: Stop Leaking Secrets in ASP.NET Core

[@jamesbest2221]

This was great! Thanks Shawn. I like these short 15 minutes videos. They're the perfect length to learn each new concept.

[@swildermuth]

Great to hear!

[@reeloriginal3359]

You've answered almost all of my questions about configuration in less time than any other video I've seen. I'm going to be binging your videos tonight. Thank you!

[@Octopie18]

I just found your channel and am glad to hear you are going to make videos more frequently. You do a very good job explaining these concepts concisely, pair them with great examples, and talking about the extra considerations we need when going further on to deployment.

[@swildermuth]

Thank you so much!

[@sirg7573]

The .AddJsonFile("appsettings.Development.config", false) - The param value of false actually enforces the presence of the file. So you should actually set it to true to ignore it (The param name is 'optional').

[@robby-de-laet]

Thanks Shawn for the effort you put in these very useful shorts. And a happy New Year!

[@swildermuth]

Happy new year!

[@catfishfortesque-smythe437]

Very good content: well-explained and demonstrated, and I really appreciate the "calm approach", with no hype, no clickbait, just solid information. In terms of a follow up video, it would be great to have an idea how we would actually automate the deployment of settings to Production in CI/CD, for example with a GitHub Action. How do we handle deployment of settings and secrets?

[@arithex]

These 10-minute explainers are so amazing -- keep them coming! As a followup to this one, I think you could do another 10-20 min just on the Azure side of things .. using KeyVault, handling secret-rotation, etc. and on Pipelines for CI/CD .. defining Variable Groups and updating Service Connections, etc.

[@swildermuth]

I'll put these on the list of possible future topics.

[@bigdaddymccoy]

That was awesome. I knew there was a place for this but never saw it taught that simple. I will double check my code for sure. I'd like to request a Coding Short on - Having my Azure Web App show a version number of the app in the bottom right corner. Maybe tied to a git build value, Azure DevOps build value or something better that you think of. I hope this makes sense.

[@danilomenagarita1181]

Thanks for all your effort. I have taken many of your courses. I really like how you explain each topic

[@swildermuth]

Great to hear!

[@biswarupkundu4102]

Hi Shawn, Good morning from India. I found your channel and I learnt something. The concept is awesome. I would like to point out a thing which I think is incorrect. AddJsonFile("", bool Optional if true), that means the file is optional, you can orr cannot keep it. AddJsonFile("", bool Optional if false), that means you must have it. In your video you explained that if bool Optional is false, that means file is optional - "its not required". Actually if its false, its required. If Its true , its not required. I would request you to please look into that part from 7.29 to 7.40 part. many thanks and great tutorials.

[@swildermuth]

You don't need the optional argument to make it required, you'd only need to supply the boolean (true) if it is optional.

[@olivier0003]

Thanks from France

[@swildermuth]

Thanks for watching!

[@dsheardown]

Great as always! Now I know I am being a little lazy here (sorry!) but the recent dotnet 7 JWT video was excellent, but would love to see a possible extension to show adding claims and how that might be handled in the new world? Also happy to watch a pluralsight course too! Or a paid course as this just keeps throwing me for whatever reason! Happy 2023!

[@swildermuth]

It's coming...still working on it.

[@fransiscustanu3039]

really great contents , if possible , perhaps you can create separate content just for shortcuts , because it seems so easy when you explain the topics , Thanks

[@swildermuth]

What do you mean "just for shortcuts"? Keyboard shortcuts?

[@NabeelFarooqui]

At 9:00 wouldn't that mean that app settings development would always be loaded and it has nothing to do with the asp net core environment?

[@alexsegal5397]

Excellent, thank you Shawn, so if a few developers work on a project before it goes to the cloud, do they need to agree on the secrets and set them in the environment so that everybody uses the same secrets?

[@swildermuth]

Depends on how the secrets are specialized. I usually have secrets that aren't valuable (e.g. connection strings to a local/dev database) checked into source control. But expect them to to be somewhat generic (e.g. connection to a localdb instance). But if you need access to valuable secrets or keys, yes...i'd share them outside of source control.

[@alexsegal5397]

@@swildermuth thank you much! Looking forward to your posts!

[@DeepakShaw]

Thanks, But why not to use Azure KeyVault..

[@swildermuth]

Depends on what you need. I find KeyVault really useful for larger organizations that need to tie secrets to AD, but for small companies/sites I find the environment variables are sufficient and safe. It depends on your level of risk really. If you have X number of developers who have access to an Azure instance and you only want some of them to know the secret information (e.g. to prevent leaking that secret), then KeyVault is the way to go. But for small companies I think it is overkill. The idea I'm trying to convey is to not leak your secrets in development cycles, whatever way you protect them is better than using config files.

[@sanseverino1833]

​@@swildermuththank you for a great video.