How to avoid storing secrets in ASP.NET source code
Tags: csharp, webdev, dotnet, tutorial
Published: 2020-01-23 15:20:44

---
title: How to avoid storing secrets in ASP.NET source code
published: true
tags: csharp, webdev, dotnet, tutorial
canonical_url: https://wellsb.com/csharp/aspnet/keep-secrets-out-of-asp-net-source-code/
---

[Original Article](https://wellsb.com/csharp/aspnet/keep-secrets-out-of-asp-net-source-code/)

It’s never a good idea to store secrets or password in your project’s source code. In an ASP.NET Core development environment, you can use the **Secret Manager** tool to store sensitive data.

## Introduction to Secret Manager

The Secret Manager tool stores your application secrets in a `secrets.json` file located in your development machine’s `%appdata%\Microsoft\UserSecrets\<UserSecretsId>\` directory.

Secret Manager is only intended to be used in a development environment. It does not encrypt the stored keys and values. Once your app is in production, you can, of course, use a service like the **Azure Key Vault**.

## Using Secret Manager

You can access secrets stored using Secret Manager the same way you would pull data from your `appsettings.json` file. However, because the secrets are not stored in your project’s directory, you run less risk of accidentally checking your passwords in to a source control repository.

To enable the Secret Manager utility, open your project in Visual Studio. Then, locate your project in the Solution Explorer. Right click the project and select **Manager User Secrets**. This will automatically generate a **UserSecretsId** in your project’s `.csproj` configuration file, and it will open the associated `secrets.json` file.

Suppose you must include a Client ID and Secret in order to access a private API. Rather than including them directly in your C# source code, you could add them to `secrets.json` as follows:

```json
{
  "ClientId": "myclientid",
  "ClientSecret": "00aaaa0a-00aa-00aa-00aa-00aaaa0000aa"
}
```

## Access Secrets in Startup

To access the data stored in the Secret Manager, simply use the Configuration API available in .NET Core. Keys are often needed as part of a project’s Startup routine, so open your project’s **Startup.cs**.

If you are not already using it, go ahead an inject an instance of the Configuration provider interface into the Startup constructor.

```csharp
public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }
 
    public IConfiguration Configuration { get; }

    ...

}

```

Now, you can use the instance in either the `ConfigureServices()` method or the `Configure() `method of **Startup.cs** using the following syntax.

```csharp
var value = Configuration["key"];

```

For example, to access the values for the two keys in the Secret Manager, ClientId and ClientSecret, you might do something similar to the following.

```csharp
string Id = Configuration["ClientId"]; //myclientid
string Secret = Configuration["ClientSecret"]; //00aaaa0a-00aa-00aa-00aa-00aaaa0000aa
```

The `Id` variable will now hold the value associated with the `ClientId` key from **secrets.json.** In other words, `Id` is a string variable with value `myclientid`. The string variable `Secret` has a value of `00aaaa0a-00aa-00aa-00aa-00aaaa0000aa`.

## Access Secrets in Blazor, Razor Pages

To use the data stored in Secret Manager in a Razor page, simply inject an instance of `IConfiguration` into the page.

```csharp
@inject IConfiguration Configuration

```

Now, you can access your secrets by using Razor syntax and the Configuration API. For example, the following would display the `ClientSecret`.

```html
<p>Your secret is @Configuration["ClientSecret"]</p>

```

## The Bottom Line

In this tutorial, you learned a useful technique for keeping sensitive data out of your ASP.NET Core project’s source code using **Secret Manager** in a development environment. This is good practice to help ensure you do not accidentally commit passwords or secrets to source control, which could put your application or users at risk.

[Source](https://wellsb.com/csharp/aspnet/keep-secrets-out-of-asp-net-source-code/)