Coding Shorts: Stop Leaking Secrets in ASP.NET Core

แชร์
ฝัง
  • เผยแพร่เมื่อ 22 ส.ค. 2024

ความคิดเห็น • 29

  • @jamesbest2221
    @jamesbest2221 ปีที่แล้ว +10

    This was great! Thanks Shawn. I like these short 15 minutes videos. They're the perfect length to learn each new concept.

  • @sirg7573
    @sirg7573 ปีที่แล้ว +2

    The .AddJsonFile("appsettings.Development.config", false) - The param value of false actually enforces the presence of the file. So you should actually set it to true to ignore it (The param name is 'optional').

  • @reeloriginal3359
    @reeloriginal3359 4 หลายเดือนก่อน

    You've answered almost all of my questions about configuration in less time than any other video I've seen. I'm going to be binging your videos tonight. Thank you!

  • @Octopie18
    @Octopie18 ปีที่แล้ว +1

    I just found your channel and am glad to hear you are going to make videos more frequently. You do a very good job explaining these concepts concisely, pair them with great examples, and talking about the extra considerations we need when going further on to deployment.

  • @robby-de-laet
    @robby-de-laet ปีที่แล้ว +2

    Thanks Shawn for the effort you put in these very useful shorts. And a happy New Year!

  • @catfishfortesque-smythe437
    @catfishfortesque-smythe437 ปีที่แล้ว

    Very good content: well-explained and demonstrated, and I really appreciate the "calm approach", with no hype, no clickbait, just solid information. In terms of a follow up video, it would be great to have an idea how we would actually automate the deployment of settings to Production in CI/CD, for example with a GitHub Action. How do we handle deployment of settings and secrets?

  • @arithex
    @arithex ปีที่แล้ว +1

    These 10-minute explainers are so amazing -- keep them coming!
    As a followup to this one, I think you could do another 10-20 min just on the Azure side of things .. using KeyVault, handling secret-rotation, etc. and on Pipelines for CI/CD .. defining Variable Groups and updating Service Connections, etc.

    • @swildermuth
      @swildermuth  ปีที่แล้ว +1

      I'll put these on the list of possible future topics.

  • @bigdaddymccoy
    @bigdaddymccoy ปีที่แล้ว

    That was awesome. I knew there was a place for this but never saw it taught that simple. I will double check my code for sure. I'd like to request a Coding Short on - Having my Azure Web App show a version number of the app in the bottom right corner. Maybe tied to a git build value, Azure DevOps build value or something better that you think of. I hope this makes sense.

  • @danilomenagarita1181
    @danilomenagarita1181 ปีที่แล้ว

    Thanks for all your effort. I have taken many of your courses. I really like how you explain each topic

  • @biswarupkundu4102
    @biswarupkundu4102 ปีที่แล้ว

    Hi Shawn, Good morning from India. I found your channel and I learnt something. The concept is awesome. I would like to point out a thing which I think is incorrect.
    AddJsonFile("", bool Optional if true), that means the file is optional, you can orr cannot keep it.
    AddJsonFile("", bool Optional if false), that means you must have it.
    In your video you explained that if bool Optional is false, that means file is optional - "its not required". Actually if its false, its required.
    If Its true , its not required.
    I would request you to please look into that part from 7.29 to 7.40 part.
    many thanks and great tutorials.

    • @swildermuth
      @swildermuth  11 หลายเดือนก่อน

      You don't need the optional argument to make it required, you'd only need to supply the boolean (true) if it is optional.

  • @fransiscustanu3039
    @fransiscustanu3039 9 หลายเดือนก่อน

    really great contents , if possible , perhaps you can create separate content just for shortcuts , because it seems so easy when you explain the topics , Thanks

    • @swildermuth
      @swildermuth  9 หลายเดือนก่อน

      What do you mean "just for shortcuts"? Keyboard shortcuts?

  • @dsheardown
    @dsheardown ปีที่แล้ว

    Great as always!
    Now I know I am being a little lazy here (sorry!) but the recent dotnet 7 JWT video was excellent, but would love to see a possible extension to show adding claims and how that might be handled in the new world?
    Also happy to watch a pluralsight course too! Or a paid course as this just keeps throwing me for whatever reason!
    Happy 2023!

    • @swildermuth
      @swildermuth  ปีที่แล้ว

      It's coming...still working on it.

  • @olivier0003
    @olivier0003 ปีที่แล้ว +1

    Thanks from France

  • @NabeelFarooqui
    @NabeelFarooqui 8 หลายเดือนก่อน

    At 9:00 wouldn't that mean that app settings development would always be loaded and it has nothing to do with the asp net core environment?

  • @alexsegal5397
    @alexsegal5397 ปีที่แล้ว

    Excellent, thank you Shawn, so if a few developers work on a project before it goes to the cloud, do they need to agree on the secrets and set them in the environment so that everybody uses the same secrets?

    • @swildermuth
      @swildermuth  ปีที่แล้ว +1

      Depends on how the secrets are specialized. I usually have secrets that aren't valuable (e.g. connection strings to a local/dev database) checked into source control. But expect them to to be somewhat generic (e.g. connection to a localdb instance). But if you need access to valuable secrets or keys, yes...i'd share them outside of source control.

    • @alexsegal5397
      @alexsegal5397 ปีที่แล้ว

      @@swildermuth thank you much! Looking forward to your posts!

  • @DeepakShaw
    @DeepakShaw ปีที่แล้ว

    Thanks, But why not to use Azure KeyVault..

    • @swildermuth
      @swildermuth  ปีที่แล้ว +1

      Depends on what you need. I find KeyVault really useful for larger organizations that need to tie secrets to AD, but for small companies/sites I find the environment variables are sufficient and safe. It depends on your level of risk really. If you have X number of developers who have access to an Azure instance and you only want some of them to know the secret information (e.g. to prevent leaking that secret), then KeyVault is the way to go. But for small companies I think it is overkill.
      The idea I'm trying to convey is to not leak your secrets in development cycles, whatever way you protect them is better than using config files.

    • @sanseverino1833
      @sanseverino1833 9 หลายเดือนก่อน

      ​@@swildermuththank you for a great video.