[Secret Manager] Inconsistent advises for recommendation of secret handling please update one of the resources!

[DevTKSS]

Description

The issued Blazor Doc page here is introducing that you recommend using the Secret Manager or User Secrets

But reading this page here about App Secrets this is clearly telling NOT to use this from what I am understanding as reader.

Please clarify this and make any of them tell us the same instead of sending us into a infinity loop until we dont know anymore where to put them best. I think Microsoft / dotnet will know about the best and recommended thing to use, isnt it? 🚀

Page URL

https://learn.microsoft.com/en-us/aspnet/core/blazor/blazor-ef-core?view=aspnetcore-9.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/blazor/blazor-ef-core.md

Document ID

2ebc5e4d-bab4-6d30-9018-9a712c482236

Platform Id

5fb075cd-0c65-79c2-a4ad-4a4658816c3b

Article author

@guardrex

Metadata

• ID: 2ebc5e4d-bab4-6d30-9018-9a712c482236
• PlatformId: 5fb075cd-0c65-79c2-a4ad-4a4658816c3b
• Service: aspnet-core
• Sub-service: blazor

Related Issues

[github-actions]

🏖️🌞 Summertime!! Woot!! 🏐⛵

Stand-by! ... A green dinosaur 🦖 will be along shortly to assist.

[guardrex]

But reading this page here about App Secrets this is clearly telling NOT to use this from what I am understanding as reader.

We do want devs to avoid storing secret data (e.g., connection strings, keys, tokens, etc.) in their apps' codebases (C# code, app config files, etc.). The Secret Manager tool is a good choice for local development to do that. We merely caution that the data isn't encrypted locally in the user's local user profile. One wouldn't use the Secret Manager for local development if you wanted locally encrypted secret data on your system (laptop/PC). For that, one might prefer something like Azure Key Vault ... or some other third-party secure data storage system.

This NOTE in this article is an INCLUDE file that appears across the Blazor docs. It only has to convey these minimal points and provide the cross-link for more information. I'm happy with the content of the INCLUDE. If anything really, I think it's a bit long. However, I'll continue to take feedback on it.

If you want to open an issue for something confusing about the security of the data for the Secret Manager tool, open it from the bottom of that article ...

https://learn.microsoft.com/aspnet/core/security/app-secrets

[DevTKSS]

@guardrex 🤔 ehm generally I would agree, but your Note there is redirecting to this article you linked and there we seem to be advised to not use this. so your doc note is advising us to use the Secret Manager and where you are linking to they do revert this.
so what I would understand from your reply is that Blazor is the base and aspnet/security/app-secrets should adhere to what you are telling us? I am open to learn new things, but then I would need to know what of those is the base and what not.

Just my guessing but I was thinking that a non-Framework/UI or whatever someone wants to choose as seperation type, would build on top of that aspnet/core/security and not the other way around 🤷
If I as newbe then beeing redirected from your blazor docs, advised this as recommended tool, then I am worried if some page about security is then telling me to better not use it as I would understand something like encryption as essential for credentials. Just my POV.

I would have more expected from reading that linked page of yours, that the advise should more be to use dotnet user-secret or dotnet jwt... (secret? dont know I am not working with jwt so far) and also possibly the azure KeyVault you mentioned instead of the maybe not so good for encryption Secret Manager for development and then the link your note has already which gives more informations.
Thats just the reader side 🤷 but I can open one for the other linked side as well, but I would expect that they will tell that blazor builds on top of them 🤷

[guardrex]

there we seem to be advised to not use this

You're only advised that the secrets aren't encrypted on your system. It's only saying that if you want encrypted secrets on your system not to use the Secret Manager tool.

The Secret Manger tool is used to store secrets for all ASP.NET Core apps, including Blazor, because it integrates with ASP.NET Core app configuration. It only works for local development. It can't be used on the server to supply secrets. AFAIK, these points are covered by the Secret Manager tool article.