Coding Shorts: Stop Leaking Secrets in ASP.NET Core

It's become too easy to leak secrets by accidently checking them in to source control. To understand how to stop leaking, you need to understand how configuration actually works. Let's take a look:

00:00 - Introduction
01:13 - Reading Secrets
02:39 - Using Environment Variables
03:00 - Using User Secrets
05:21 - Debugging Configuration Sources
06:47 - Setting Up Configuration Manually
09:38 - Secrets in Azure
12:34 - Wrapping Up

If you like this video, you might like other videos in my Instructional Videos:

You can reach me at my new website:

[jamesbest]

This was great! Thanks Shawn. I like these short 15 minutes videos. They're the perfect length to learn each new concept.

[sirg]

The .AddJsonFile("appsettings.Development.config", false) - The param value of false actually enforces the presence of the file. So you should actually set it to true to ignore it (The param name is 'optional').

[reeloriginal]

You've answered almost all of my questions about configuration in less time than any other video I've seen. I'm going to be binging your videos tonight. Thank you!

[Octopie]

I just found your channel and am glad to hear you are going to make videos more frequently. You do a very good job explaining these concepts concisely, pair them with great examples, and talking about the extra considerations we need when going further on to deployment.

[catfishfortesque-smythe]

Very good content: well-explained and demonstrated, and I really appreciate the "calm approach", with no hype, no clickbait, just solid information. In terms of a follow up video, it would be great to have an idea how we would actually automate the deployment of settings to Production in CI/CD, for example with a GitHub Action. How do we handle deployment of settings and secrets?

[robby-de-laet]

Thanks Shawn for the effort you put in these very useful shorts. And a happy New Year!

[arithex]

These 10-minute explainers are so amazing -- keep them coming!

As a followup to this one, I think you could do another 10-20 min just on the Azure side of things .. using KeyVault, handling secret-rotation, etc. and on Pipelines for CI/CD .. defining Variable Groups and updating Service Connections, etc.

[bigdaddymccoy]

That was awesome. I knew there was a place for this but never saw it taught that simple. I will double check my code for sure. I'd like to request a Coding Short on - Having my Azure Web App show a version number of the app in the bottom right corner. Maybe tied to a git build value, Azure DevOps build value or something better that you think of. I hope this makes sense.

[danilomenagarita]

Thanks for all your effort. I have taken many of your courses. I really like how you explain each topic

[dsheardown]

Great as always!

Now I know I am being a little lazy here (sorry!) but the recent dotnet 7 JWT video was excellent, but would love to see a possible extension to show adding claims and how that might be handled in the new world?

Also happy to watch a pluralsight course too! Or a paid course as this just keeps throwing me for whatever reason!

Happy 2023!

[biswarupkundu]

Hi Shawn, Good morning from India. I found your channel and I learnt something. The concept is awesome. I would like to point out a thing which I think is incorrect.

AddJsonFile("", bool Optional if true), that means the file is optional, you can orr cannot keep it.
AddJsonFile("", bool Optional if false), that means you must have it.

In your video you explained that if bool Optional is false, that means file is optional - "its not required". Actually if its false, its required.

If Its true, its not required.

I would request you to please look into that part from 7.29 to 7.40 part.

many thanks and great tutorials.

[fransiscustanu]

really great contents, if possible, perhaps you can create separate content just for shortcuts, because it seems so easy when you explain the topics, Thanks

[NabeelFarooqui]

At 9:00 wouldn't that mean that app settings development would always be loaded and it has nothing to do with the asp net core environment?

[alexsegal]

Excellent, thank you Shawn, so if a few developers work on a project before it goes to the cloud, do they need to agree on the secrets and set them in the environment so that everybody uses the same secrets?

[DeepakShaw]

Thanks, But why not to use Azure KeyVault..