Sensitive information

As explained in ASP.NET Core in Action, 3e

Sensitive data is information whose disclosure or misuse could harm a person, system, or organization.

Sensitive information includes passwords, connection strings, and API keys whose disclosure or misuse could harm a person, system, or organization. Keep these values out of appsettings.json and source control. section 10.2.3

Use separate storage approaches for development and production:

• Store local development secrets with User Secrets outside the project folder. section 10.2.3
• Store production secrets in environment variables rather than committed configuration files. section 10.2.3
• Treat User Secrets and environment variables as protection against accidental commits, not encryption; consider Azure Key Vault or Vault for encrypted storage. section 10.2.3

Figure 10.5 Choose Manage User Secrets to open an editor for the User Secrets app. You can use this file to store secrets when developing your app locally. These secrets are stored outside your project folder, so they won’t be committed to source control accidentally.

Shows where local User Secrets are managed and why storing them outside the project folder helps prevent accidental source-control commits. section 10.2.3

How ASP.NET Core in Action, 3e covers it

How deep it goes

Explains secret types, storage choices, configuration loading, and security limits, but stops short of detailed encryption implementation.

Examples

Uses passwords, connection strings, API keys, appsettings.json, User Secrets, environment variables, and Azure Key Vault.

What it assumes

Assumes a nontrivial application with configuration settings and distinguishes local development from production deployment.

What you can do after

Operate/configure local and production secret storage without committing sensitive values to source control.

How it connects

Connects sensitive information with configuration, source control, environment variables, User Secrets, and Azure Key Vault.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Effective Data AnalysisProtected information is data subject to legal, regulatory, or organizational restrictions governing its collection, use, disclosure, or retention.
• 

  liveBookmanning.com
  The Art of AI Product DevelopmentInformation owned or controlled by an organization and not generally available for unrestricted public use.
• 

  liveBookmanning.com
  Generative AI in ActionEnterprise data is organization-owned information that may be subject to access restrictions, privacy requirements, and legal obligations.
• 

  liveBookmanning.com
  Introduction to Generative AI, Second EditionProprietary data is information owned or controlled by an organization and not generally available to the public.
• 

  liveBookmanning.com
  Practical Automation with PowerShell: Effective scripting from the console to the cloudSensitive data is information whose unauthorized disclosure, alteration, or loss could cause harm or compromise security.
• 

  liveBookmanning.com
  Think Like a CTOSensitive data is information requiring additional protection because unauthorized access or disclosure could cause harm or violate obligations.
• 

  liveBookmanning.com
  Bootstrapping Microservices, Second Edition: With Docker, Kubernetes, GitHub Actions, and TerraformA sensitive value is configuration or state data whose disclosure could compromise security and is therefore specially protected in displayed or stored form.

Compare how 8 books explain sensitive information →

Related concepts

• personal dataincludes · Personal data is information relating to an identified or identifiable person, directly or indirectly, alone or in combination with other information.
• fine-tuningused by · Fine-tuning is adapting a pretrained machine-learning model by training it further on targeted data or objectives for a task, domain, or behavior.
• datakind of · Data is represented information, observations, measurements, or other values that can be stored, processed, transmitted, analyzed, or interpreted.
• password authenticationincludes · Password authentication is an authentication method that verifies a claimed identity or access by checking a supplied secret password or passphrase.
• retrieval-augmented generationused by · Retrieval-augmented generation is a technique that retrieves relevant information from external sources and supplies it as context to a generative model when producing an output.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.