Safe storage of app secrets for Blazor Webassembly app

user_3860630 0
Viewed 2899

I am searching on the way for safe storage of app secrets in blazor webassembly application. We can find details for Server Side application as in below MSDN documentation.

https://docs.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-3.1&tabs=windows

How can we use these kind of secrets for Blazor WebAssembly application which completely runs in client browser?

My basic scenario is, need to keep the passwords, product key (licensing key) information out of application code. For example, we load license inside the static main method of Program.cs.

https://i.stack.imgur.com/kCrV1.png

 public class Program
    {
        public static async Task Main(string[] args)
        {
            //want to access the product key here and need to avoid hardcoding
            SomeThirdPartyLibrary.RegisterLicense("product-key");
            var builder = WebAssemblyHostBuilder.CreateDefault(args);
            builder.RootComponents.Add<App>("app");

            builder.Services.AddTransient(sp => new HttpClient { BaseAddress = new Uri(builder.HostEnvironment.BaseAddress) });

            await builder.Build().RunAsync();
        }

I have searched in documentation of blazor and not able to find any details for this. Please help me to find the recommended way resolving this in Blazor webassembly.

(for server-side, we have variety of option but for client-side what might be the recommended way)

secret-manager blazor-webassembly blazor
2 Answers
user_613110

you can use memory config by using MemoryConfigurationSource

example:

var appsettings = new Dictionary<string, string>()
{
   { "API:Key", "12345" }
};
var config = new MemoryConfigurationSource(InitialData = appsettings);
builder.Configuration.Add(memoryConfig);

then whatever you want to use it, just @inject configuration (in razor pages) or in your class program that will look like:

builder.Configuration.GetValue<string>("API:Key")
user_140524810
Related