dotnet / dotnet/AspNetCore.Docs

Update Data Protection docs to include default behavior when deploying ASP.NET Core apps to ACA

Open
#32,530 1 comment 1 reaction 1 assignee Claimed by @tdykstra View on GitHub
:bomb: vanQUEST aspnet-core/svc security/subsvc seQUESTered Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

### Description

**Current scenario:** ASP.NET Core apps that need to encrypt ephemeral data use [Data Protection](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Faspnet%2Fcore%2Fsecurity%2Fdata-protection%2Fintroduction&data=05%7C02%7CClaudia.Regio%40microsoft.com%7C5c01574c7e0f4ab0fa6608dc49ef17bd%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638466538451353180%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=g1zQf3x5UU7rEd9YlFr2OJP%2F66bBVixpYP4TOthi%2BMY%3D&reserved=0). If a developer does not configure Data Protection, it defaults to storing the keys on disk. This works fine for single instance applications, but when these apps are deployed to ACA that auto-scales, the app breaks because there is currently​ no way to share the keys between these instances without explicit configuration by the app author.

**Changes:** Now, when a user creates a new ASP.NET Core app that pulls in Data Protection, an environment variable that has been added will put Data Protection in read-only mode by default (https://github.com/dotnet/aspnetcore/pull/54266). If a user decides to configure data protection themselves, it will override the default. This change has been backported to .NET 8 so it will work for any version 8 or higher. When ACA detects a .NET app is being deployed, they set their environment variable "autoConfigureDataProtection" to true and will spin up a key manager and will handle the writing/sharing keys across multiple instances when the app auto-scales (https://github.com/Azure/azure-rest-api-specs/pull/28001). This allows ASP.NET Core apps that pull in Data Protection to easily scale horizontally when deployed to ACA by providing a default configuration.

**Ask:** This is a high-priority end-to-end scenario so I'd like to add docs specific to the default behavior when deploying an ASP.NET Core app to Azure Container Apps that talk about the new default behavior.

Will need to be reviewed by @amcasey, @adityamandaleeka, @bradygaster, @AnqiLi6, @blowdart

Ideal ship timeline: May 21st - May 27th

### Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction?view=aspnetcore-8.0

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/data-protection/introduction.md

### Document ID

d42b1eab-9682-ea69-f203-e519b456a56f

### Article author

@Rick-Anderson

---
[Associated WorkItem - 252761](https://dev.azure.com/msft-skilling/Content/_workitems/edit/252761)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.