dotnet / dotnet/AspNetCore.Docs
Update Data Protection docs to include default behavior when deploying ASP.NET Core apps to ACA
- Dominant language
- C#
- Stars
- 13.1k
- Forks
- 24.6k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 97
Description
### Description
**Current scenario:** ASP.NET Core apps that need to encrypt ephemeral data use [Data Protection](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Faspnet%2Fcore%2Fsecurity%2Fdata-protection%2Fintroduction&data=05%7C02%7CClaudia.Regio%40microsoft.com%7C5c01574c7e0f4ab0fa6608dc49ef17bd%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638466538451353180%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=g1zQf3x5UU7rEd9YlFr2OJP%2F66bBVixpYP4TOthi%2BMY%3D&reserved=0). If a developer does not configure Data Protection, it defaults to storing the keys on disk. This works fine for single instance applications, but when these apps are deployed to ACA that auto-scales, the app breaks because there is currently no way to share the keys between these instances without explicit configuration by the app author.
**Changes:** Now, when a user creates a new ASP.NET Core app that pulls in Data Protection, an environment variable that has been added will put Data Protection in read-only mode by default (https://github.com/dotnet/aspnetcore/pull/54266). If a user decides to configure data protection themselves, it will override the default. This change has been backported to .NET 8 so it will work for any version 8 or higher. When ACA detects a .NET app is being deployed, they set their environment variable "autoConfigureDataProtection" to true and will spin up a key manager and will handle the writing/sharing keys across multiple instances when the app auto-scales (https://github.com/Azure/azure-rest-api-specs/pull/28001). This allows ASP.NET Core apps that pull in Data Protection to easily scale horizontally when deployed to ACA by providing a default configuration.
**Ask:** This is a high-priority end-to-end scenario so I'd like to add docs specific to the default behavior when deploying an ASP.NET Core app to Azure Container Apps that talk about the new default behavior.
Will need to be reviewed by @amcasey, @adityamandaleeka, @bradygaster, @AnqiLi6, @blowdart
Ideal ship timeline: May 21st - May 27th
### Page URL
https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction?view=aspnetcore-8.0
### Content source URL
https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/data-protection/introduction.md
### Document ID
d42b1eab-9682-ea69-f203-e519b456a56f
### Article author
@Rick-Anderson
---
[Associated WorkItem - 252761](https://dev.azure.com/msft-skilling/Content/_workitems/edit/252761)
Contributor guide
Assessment
This issue has not been assessed yet.