dotnet user-secrets should allow for entry from stdin without echo
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is your feature request related to a problem? Please describe.
`dotnet user-scripts add ` has at least two problems:
1. Depending on the shell, different symbols are escaped. In PowerShell, "woohoo i got $$!" will replace `$$` with some token based on context. Bash has its own issues, apparently: https://github.com/aspnet/UserSecrets/issues/76 . And Windows Terminal behaves differently from cmd.exe. All in all, there's far too much room for error, especially when entering things like passwords.
2. Many shells and terminals log all inputs as a convenience feature, which could lead to accidental exposure of secrets.
### Describe the solution you'd like
An interaction like this would be nice:
```
> dotnet user-secrets set
Enter secret name: test
Enter secret value:
Successfully saved test = <25 characters>
```
Or, entering `dotnet user-secrets set "test"` prompts for the value.
In either case, I think a warning to encourage users to enter values this way would also be helpful.
### Describe alternatives you've considered
Writing directly to the to `secrets.json`, aside from being cumbersome, suffers a similar problem as *1*, as the user would need to be aware of JavaScript's escape sequences.
Contributor guide
Assessment
This issue has not been assessed yet.