#appsettings

No IFrame For You

Security isn’t easy, but its becoming more important. There’s lots of evidence explaining the dangers of missing any flaws. One of the items that got flagged on a project that allowed IFrames from any other site. The findings referenced the X-Frame-Options header. In my particular case, the business wanted to allow IFraming across domains. This ruled out using DENY or SAMEORIGIN. ALLOW-FROM would…

Configuring application settings for Azure Web App is one such topic where we have multiple options to maintain these settings. Let’s look at those options and see when to use what.

web.config

The first obvious place where you can configure all your application settings and  connection strings is web.config file which would be part of your application package.

we have been using this file to store all the settings which will impact our application behavior. Few examples of what we can store in this file would be like API or other external Uri’s, database connection strings,  secrets or keys,  connection strings for other azure/3rd party services and infact anything which should be able to configured at a later point of time without touching the application code.

But, it is not good for storing secrets, keys and connection strings of non-development environment in this file as it would be directly available for developer who is working on the application.

So, what is the other option we have to store these secrets without exposing them to all the members in the team?

Application Settings (in Azure Portal)

This works as a layer on top of web.config file in the application package. which means that any setting we configure in Application Settings blade of Azure Web App will override the existing setting present in web.config file (if any).

This way, all the actual secrets, keys and connection strings can be hidden from the team except those  who deal with Azure Provisioning and Releases.

So, we can store all common settings in web.config and store secrets, keys and connection strings within Azure Web App Application Settings as a best practice.

This is similar to how we maintain web.config transform files. App Settings in Azure Portal is like Release version of web.config.

web.config Transformations

Do we have any other options apart from this to store application secrets and keys?

Let’s think of a scenario where in you’re moving your application to production and you do not want any of the DevOps teams to know the production Keys, Secrets and Connection strings.

you got anything in mind?

Azure Key Vault

Yes, we have Azure Key Vault offering from Microsoft Azure to safeguard secrets, keys and connection strings of all the cloud applications and services.

With Azure Key Vault, you can store all the secrets and cryptographic keys in it and just expose them as a REST Uri to consume from the application without actually exposing the values stored in it.

Also, in order to use this service, you must register your application with Azure AD and provide the AD token to KeyVault every time you want to read a key value, which add an extra layer of security to your application secrets and keys.

This would be a recommended offering provided by azure for all the secrets and keys of production applications.

Hope you enjoyed reading this post and let me know if there are any other better ways to do this. I would be happy to learn.

Happy Coding!!!

vb ile config dosyası okuma

Merhaba Çalıştığımız projelerde veya yazdığımız kodlarda çoğu zaman bir config dosyasına ihtiyaç duyarız. Bu gibi durumlarda config içerisine yazdığımız verileri okumakda önemli oluyor. Bunun için çok basit olarak config doyasından veri okumayı hazırlayalım. İlk olarak projemizi oluşturalım ve projemizse referans olarak System.Configurationdll ini ekleyelim. Daha sonra okuma işlemini…

c# ile config dosyası okuma

Merhaba Çalıştığımız projelerde veya yazdığımız kodlarda çoğu zaman bir config dosyasına ihtiyaç duyarız. Bu gibi durumlarda config içerisine yazdığımız verileri okumakda önemli oluyor. Bunun için çok basit olarak config doyasından veri okumayı hazırlayalım. İlk olarak projemizi oluşturalım ve projemizse referans olarak System.Configurationdll ini ekleyelim. Daha sonra okuma işlemini…

Fixed Reading settings from app.config or web.config in .net #dev #it #asnwer

Reading settings from app.config or web.config in .net

I’m working on a C# class library that needs to be able to read settings the web.config or app.config file (depending on whether the DLL is referenced from an ASP.NET web application or a Windows Forms application).

I’ve found that ConfigurationSettings.AppSettings.Get("MySetting")works, but that code has been marked as deprecated by…