2

I came across Hangfire in order to build background jobs using ASP.NET core MVC, and I have presented this idea to my manager and his concern was in terms of security, and some of the questions were as follow.

  • Does Hangfire Server have access to sensitive data that will be implemented within the application?
  • How does the Hangfire Server trigger the jobs implemented within the code?
  • Is there any sensitive data saved in the Hangfire Server?

I would appreciate any suggestion or information regarding security for Hangfire.

Dale K
  • 25,246
  • 15
  • 42
  • 71
aldo23
  • 39
  • 7

1 Answers1

2

Does Hangfire Server have access to sensitive data that will be implemented within the application?

It won't have more access than any other nuget package loaded in your application.

How does the Hangfire Server trigger the jobs implemented within the code?

A job is running in the background and polls the Hangfire database regularly for new jobs to perform. If a new job is found, its invocation data stored in the database is deserialized, and the resulting method is invoked through reflection with the deserialized parameters.

Is there any sensitive data saved in the Hangfire Server ?

It depends on you. Every job parameter is serialized in Hangfire database. If it is a concern (you don't control, or you share, the hangfire database), you can just pass identifiers, and retrieve the corresponding values in your own database during processing of the job.

For example if you call

BackgroundJob.Enqueue(() => HandleSensitiveData(new SensitiveData{Id="123", Value="VerySensitiveData"}));

VerySensitiveData will be stored in the hangfire database, with the whole serialized SensitiveData object

But if SensitiveData with Id 123 is in your DB, and you call

BackgroundJob.Enqueue(() => HandleSensitiveDataFromId("123"));

Only 123 is saved in Hangfire DB, and you just have to retrieve the object with Id 123 upon when executing HandleSensitiveDataFromId. VerySensitiveData is never stored in the Hangfire DB

jbl
  • 15,179
  • 3
  • 34
  • 101
  • Thanks for your reply jbl, My biggest concern is if HangFire Server saves sensitive data in the server since we might implement confidential data within applications that compromise security. I would appreciate it If you can elaborate a bit more on the last question. Thanks again. – aldo23 Dec 15 '21 at 14:24
  • 1
    @aldo23 added some example – jbl Dec 15 '21 at 17:04