dotnet / dotnet/efcore

Bundle application defaults to using development aspnet environment

Open
#36,188 1 comment 1 reaction 1 assignee Claimed by @AndriySvyryd View on GitHub
area-migrations area-tools breaking-change needs-design
Dominant language
C#
Stars
14.8k
Forks
3.4k
PR merge metrics
PR metrics pending

Description

### Summary

Runing the ef bundle seems to defaults to using the developement aspnet environment, which make the bundle load the user secrets associated to the startup project, which might pose security risks to users.

### Details

When creating an ef bundle to apply migrations, I was suprised to find out that the app failed in CI and worked on my machine. The problem was apparently that some configuration was missing, preventing the Hosting service provider to build, and the bundle from resolving the dbcontext. This happened because somewhere in the registration of services, we made sure certain configuration keys were present (which is bad practice and was fixed later).

However, I was suprised running the bundle actually worked on my development machine, as the values were absent from the appsettings.json or environment versions of the appsettings file. It turned out the script started failing as soon as I commented the values of my secrets.json.

I tried different strategies, like removing launchSettings.json, building the bundle in Release configuration, etc ... but the bundle consistently worked on my computer unless removing the secrets, or setting ASPNET_ENVIRONMENT to Production explicitly. Which means that the bundle *defaults* to using Development environment which in turns make the WebApplicationBuilder to load user secrets using the Guid that was in the starup project csproj file at build time.

I'm not sure users are fully aware that running the efbundle actually loads secrets by default, and I'm not sure this is a safe behavior. I sugest to make that it defaults to Production. Or perhaps defaults to Development in Debug and Production in Realse ? Or at least add some documentation on this.

### Include provider and version information
EF Core version: 9.0.5
Database provider: Microsoft.EntityFrameworkCore.SqlServer
Target framework: net9.0
Operating system: windows 11 23H2
IDE: -

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.