C#•3mo ago

ASP.NET Core, prevent environment variables being exposed in launchsettings.json

I made my github repository public and immediately got an email from SendGrid saying my api key has been disabled cuz It was detected somewhere public. How do I tackle this, cuz all envarionment variables are in launchsettings? New to envirnoment variables. Prevent laucnhsetting.json from being pushed to GitHub?

12 Replies

FusedQyou•3mo ago

Secrets! Simplest way, use Environment.GetEnvironmentVariable and get a secret that way

TrattTrattOP•3mo ago

okay thanks, AI said I could GitIgnore launchsettings if thats easier?

FusedQyou•3mo ago

Generally these are ignored but I don't do it I don't have a lot in launchsettings so it's valid for everybody, but it sounds like you store data in there Generally I just place data in appsettings, unless it's confidential like keys In that case they go into a secret

TrattTrattOP•3mo ago

okey Ill try to make it secret, thank you

FusedQyou•3mo ago

One thing I did was make this extension method:

internal static class ConfigurationUtils
{
    internal static string ParseConfigurationEntry(string entry)
    {
        const string secretPrefix = "secret:";
        var isSecret = entry.StartsWith(secretPrefix, StringComparison.OrdinalIgnoreCase);
        if (isSecret)
        {
            entry = entry[secretPrefix.Length..];
            var environmentVariable = Environment.GetEnvironmentVariable(entry);
            if (string.IsNullOrEmpty(environmentVariable))
            {
                throw new ArgumentNullException(nameof(environmentVariable), "Missing `" + environmentVariable + "` environment variable.");
            }

            return environmentVariable;
        }

        return Environment.ExpandEnvironmentVariables(entry);
    }
}

internal static class ConfigurationUtils
{
    internal static string ParseConfigurationEntry(string entry)
    {
        const string secretPrefix = "secret:";
        var isSecret = entry.StartsWith(secretPrefix, StringComparison.OrdinalIgnoreCase);
        if (isSecret)
        {
            entry = entry[secretPrefix.Length..];
            var environmentVariable = Environment.GetEnvironmentVariable(entry);
            if (string.IsNullOrEmpty(environmentVariable))
            {
                throw new ArgumentNullException(nameof(environmentVariable), "Missing `" + environmentVariable + "` environment variable.");
            }

            return environmentVariable;
        }

        return Environment.ExpandEnvironmentVariables(entry);
    }
}

The idea is that appsettings can still hold data in development so it's easier and this is not confidential However, in production they are replaced with the secret that I can find the data from Then it's like this: Dev

"DataConfiguration": {
  "ConnectionString": "DataSource=%TEMP%/Project/app.db"
},

"DataConfiguration": {
  "ConnectionString": "DataSource=%TEMP%/Project/app.db"
},

Prod

"DataConfiguration": {
  "ConnectionString": "secret:CONNECTIONSTRING"
}

"DataConfiguration": {
  "ConnectionString": "secret:CONNECTIONSTRING"
}

Very simple abstraction keeps it easy to develop anywhere, but ensures no confidential data leak when published for production

TrattTrattOP•3mo ago

okay Ill try to maye it a secret to start with, as its a sensitive Api key

FusedQyou•3mo ago

I would advice you just make it a secret regardless I don't have sensitive API keys myself but it would work in your case too. Both instances just have to read from a secret

TrattTrattOP•3mo ago

okay Ill try thanks a lot

Unknown User•3mo ago

Message Not Public

FusedQyou•3mo ago

I'd love to see a proper solution for both cases instead of "don't do this"

Unknown User•3mo ago

Message Not Public

TrattTrattOP•3mo ago

Ill have a look, thanks

Gaming

Programming

ASP.NET Core, prevent environment variables being exposed in launchsettings.json