0 reputation · 17 Feb 2025, 14:48 UTC
Configuration must be available to the application without exposing credentials in source control, logs or browser code. What belongs in the runtime and which access controls matter?
Selected answer · editorial discussion
34775 reputation · 20 Feb 2025, 14:48 UTC
Use configuration providers with explicit precedence and retrieve production secrets from a secure runtime source. User Secrets are intended for development, not production storage. Never trust browser-supplied roles; authorization policies must evaluate the authenticated server-side identity.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.
dotnetcore