.NET Core 3.1 Secure credentials when deploying to generic hosting

user_1345055 0
Viewed 396

My question has two parts but they are both about secure credential storage. The background is that I am using a basic hosting service with ftp to deploy my .net core 3.1 site. I don't have directory access beyond the root folder of where I deploy my files. I am using sql server and a few other third party services that require me to use API keys.

For development, all the documentation from the different third parties have me either use the windows credential storage or put a file somewhere on the file system outside of the solution folder. But that is not an option for deployment.

So my questions are, For deployment to this hosting service...
1. Is it safe to use appsettings.json to store my API keys?
2. Also, is it save to just put a flat text file in the root of my site so it's not reachable by the public and then just pull that in at runtime?

asp.net-core-3.1 asp.net-core security
1 Answers

1.Is it safe to use appsettings.json to store my API keys?

NO If you are using third party hosting service using FTP to a folder, it not safe to assume only you can see your deployment files.

  1. Also, is it save to just put a flat text file in the root of my site so it's not reachable by the public and then just pull that in at runtime?

It is same as using appsettings.json to store API keys since appsettings files should not be exposed publicly too.

What I can suggest is to either use some third party secure tool like Azure Vault or Hashi Vault to store secrets(they are encrypted there) & consume in your application.

If you don't want to use third party service, you can create custom Configuration Builder where you can encrypt the secrets before saving & decrypt before using.

public class CustomConfigProvider : ConfigurationProvider
    {
        public CustomConfigProvider() { }

        public override void Load()
        {
            Data = MyEncryptUtils.DecryptConfiguration();
        }
}

public class CustomConfigurationSource : IConfigurationSource
{
    public CustomConfigurationSource() { }


    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new CustomConfigProvider();
    }
}

public class CustomConfigurationSource : IConfigurationSource
{
    public CustomConfigurationSource() { }


    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new CustomConfigProvider();
    }
}

Call in startup 

var builder = new ConfigurationBuilder()
            .AddJsonFile("appsettings.json")
            .AddCustomConfiguration()
            .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true);

Source: https://stormpath.com/blog/store-protect-sensitive-data-dotnet-core

Also there is alternate approach using bridge pattern & encryption by Steve here: https://stevetalkscode.co.uk/configuration-bridging-part-4

user_7040080
Related