Entity Framework Core Interview Question #195

How should secrets and connection strings be managed?

Testing, Production Practices & Senior Real-World Scenarios Senior Advanced

Quick Interview Answer

Do not hard-code production credentials in source code or commit them to repositories. Use environment-specific secure configuration such as secret stores, managed identity, environment variables, or deployment-platform secret facilities. Apply least privilege to database accounts and rotate credentials according to organizational policy.

Detailed Explanation

Do not hard-code production credentials in source code or commit them to repositories. Use environment-specific secure configuration such as secret stores, managed identity, environment variables, or deployment-platform secret facilities. Apply least privilege to database accounts and rotate credentials according to organizational policy.

Code Example

var connectionString =
    builder.Configuration.GetConnectionString("DefaultConnection");