dotnet / dotnet/aspnetcore

dotnet user-secrets should allow for entry from stdin without echo

Open
#28,094 2 comments 1 reaction 0 assignees View on GitHub
affected-very-few area-commandlinetools enhancement feature-user-secrets severity-nice-to-have
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is your feature request related to a problem? Please describe.

`dotnet user-scripts add ` has at least two problems:

1. Depending on the shell, different symbols are escaped. In PowerShell, "woohoo i got $$!" will replace `$$` with some token based on context. Bash has its own issues, apparently: https://github.com/aspnet/UserSecrets/issues/76 . And Windows Terminal behaves differently from cmd.exe. All in all, there's far too much room for error, especially when entering things like passwords.

2. Many shells and terminals log all inputs as a convenience feature, which could lead to accidental exposure of secrets.

### Describe the solution you'd like
An interaction like this would be nice:
```
> dotnet user-secrets set
Enter secret name: test
Enter secret value:
Successfully saved test = <25 characters>
```

Or, entering `dotnet user-secrets set "test"` prompts for the value.

In either case, I think a warning to encourage users to enter values this way would also be helpful.

### Describe alternatives you've considered
Writing directly to the to `secrets.json`, aside from being cumbersome, suffers a similar problem as *1*, as the user would need to be aware of JavaScript's escape sequences.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.