Installing and using Secret Manager on ASP.NET Core

In your ASP.NET Core application you can load settings from a file named secrets.json that can store API ids and secrets. The default generated template includes:

if (env.IsDevelopment())
{
    builder.AddUserSecrets();
}

That is going to add that file only on a development environment. So the whole point of using this secret storage is to avoid having your ClientId and ClientSecret exposed on source control. In production you can have it stored on environment settings, the generated template includes:

builder.AddEnvironmentVariables();

Which is going to add the environment variables on your application configuration.

In order to do that first test your environment by typing dnx in the command prompt. If it doesn’t find dnx then run the following:

cd %userprofile%\.dnx\runtimes\dnx-coreclr-win-x64.1.0.0-rc1-update1\bin
dnvm upgrade

This is going to update the path and other things, after that you can run this other command to install the SecretManager:

dnu commands install Microsoft.Extensions.SecretManager

To finally store the application secrets you can run (on your project folder where you find project.json):

user-secret set Authentication:Google:ClientId <yourId>
user-secret set Authentication:Google:ClientSecret <yourSecret>

In the %APPDATA%\microsoft\UserSecrets folder there is going to be a folder for your project and then a secrets.json inside.

secrets

Then finally using it on your application, install Google Authentication:

Install-Package Microsoft.AspNet.Authentication.Google -Pre

Note the -Pre option, as of the date of this post this package will not be found if you do not include this option.

app.UseGoogleAuthentication(options=> 
{
    options.ClientId = Configuration["Authentication:Google:ClientId"];
    options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
});
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s