This is a follow up to a question and excellent answer on: ASPNET_REGIIS: Place AES key and IV into a KeyContainer
What is the appropriate way for managing secret data that should be encrypted?
The previous posting focused on ASP.NET MVC. I am now migrating to ASP.NET CORE, which handles the web.config differently. Specifically, it converts the file web.config from XML to JSON and renames it as appsetting.json file. OK, easy enough.
BUT, the security is handled much differently. Specifically, with ASP.NET MVC I could encrypt the web.config file and the application would run with no problem. But, in .NET CORE, I am directed to use the Security Manager with the caveat that it does not encrypt data. So what is the purpose of a security manager that...uh... is missing security (if we are speaking in the truest and purest sense of the word)?
https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-2.0&tabs=windows
The Secret Manager tool doesn't encrypt the stored secrets and shouldn't be treated as a trusted store. It's for development purposes only. The keys and values are stored in a JSON configuration file in the user profile directory.
That seems OK because I understand that the data is encrypted by the user's key. So, only myself or a computer administrator can read the data. But then I read this:
Don't write code that depends on the location or format of data saved with the Secret Manager tool. These implementation details may change. For example, the secret values aren't encrypted, but could be in the future.
MVC does not impose the encryption pickiness that CORE seems to ensure because I can encrypt in any environment that I want. Am I understanding this wrong?
