dotnet / dotnet/aspnetcore

Encrypt secrets in dotnet user-secrets

Open
#48,306 6 comments 4 reactions 0 assignees View on GitHub
area-commandlinetools feature-user-secrets
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

_No response_

### Describe the solution you'd like

The dotnet user-secrets [docs](url) helpfully make very clear the secrets being stored are stored in plain text. Later on they state "the secret values aren't encrypted, but could be in the future."

This is a request to add support for encrypting the stored secrets. For our purposes the Windows specific DPAPI would be sufficient, I'm no expert but aware it is more complex for other operating systems.

Handily the [code](https://github.com/dotnet/aspnetcore/blob/main/src/Tools/dotnet-user-secrets/src/Internal/SecretsStore.cs#LL83C35-L83C35) is already making an OS check on the save side.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.