A key file is a small XML file containing the random cryptographic key value that ASP.NET Core data protection uses to encrypt and decrypt data. The same key lets the application read protected authentication cookies and validate security tokens. section 29.2
Protect key files and choose storage that matches the hosting environment:
- Treat the file as highly sensitive: anyone who obtains it may impersonate users and access protected data. section 29.2
- Use the hosting environment’s protected location, such as an Azure Web App synced folder, encrypted registry storage, or the user-profile data-protection directory. section 29.2
- In a web farm, store keys centrally—for example in a shared folder, Redis, or Azure Blob Storage—so every server can decrypt the same cookies. section 29.2
- Avoid relying on in-memory keys when protected data must survive restarts; those keys are lost when the application stops. section 29.2
