ASP.NET Core Interview Question #147

How should application secrets be managed in ASP.NET Core?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Secrets such as production passwords, API keys, signing credentials, and connection-string passwords should not be committed to source control or embedded in application code.

Detailed Explanation

Secrets such as production passwords, API keys, signing credentials, and connection-string passwords should not be committed to source control or embedded in application code.

During local development, .NET user secrets can keep sensitive settings outside the project directory. Production environments should use protected environment configuration or a dedicated secret-management service appropriate to the hosting platform.

Access should follow least privilege, secrets should be rotatable, and sensitive values should not be written to logs.

Code Example

// Read through configuration; source varies by environment.
var apiKey = builder.Configuration["ExternalApi:ApiKey"];

// Development example:
// dotnet user-secrets set "ExternalApi:ApiKey" "..."