ASP.NET Core Interview Question #33

How should secrets be managed in ASP.NET Core?

Application Structure & Configuration Junior Beginner

Quick Interview Answer

Secrets such as passwords, API keys, client secrets, and signing keys should not be hard-coded in source code or committed to appsettings.json in a public repository.

Detailed Explanation

Secrets such as passwords, API keys, client secrets, and signing keys should not be hard-coded in source code or committed to appsettings.json in a public repository.

During local development, ASP.NET Core User Secrets can store sensitive values outside the project directory. In production, secrets are commonly supplied through environment variables, managed secret stores, or services such as Azure Key Vault.

The application still accesses these values through the configuration system, which means code can remain independent of the actual secret provider.

Code Example

// Development
// dotnet user-secrets set "ExternalApi:ApiKey" "secret-value"

var apiKey = builder.Configuration["ExternalApi:ApiKey"];