ASP.NET Core Web API Interview Question #72
How should API secrets and signing keys be stored?
Authentication, Authorization, JWT & API Security Mid-Level Intermediate
Quick Interview Answer
Secrets should not be committed to source control or embedded in application code. Development can use mechanisms such as .NET User Secrets, while production commonly uses environment-specific secret stores, managed identity, environment variables, or platform key-management services.
Detailed Explanation
Secrets should not be committed to source control or embedded in application code. Development can use mechanisms such as .NET User Secrets, while production commonly uses environment-specific secret stores, managed identity, environment variables, or platform key-management services.
Access should follow least privilege, and secrets should support rotation. Asymmetric signing keys or identity-provider-managed keys are often preferable to distributing a shared signing secret across many services.
Code Example
// Development:
dotnet user-secrets set "Jwt:SigningKey" "..."
var key = builder.Configuration["Jwt:SigningKey"];