Best practice to hide connection string password
# help-with-umbraco
c
Hi, new to umbraco and wondering how we can hide the connection string in appsettings.json? Is it possible to be loaded from .env? I have googled quite a bit but can't find anything around the topic really.
d
Hey there!! It depends on your hosting environment. On IIS for example, you can define secrets in the application pool settings. On Azure you could use keyvault or app service configuration.
c
Hey, I am using docker
I have umbraco in one container, mssql on another. Have them talking to each other no problem, would just like to understand umbraco/.net environment better
Coming from a primarily nodejs based background
d
Well the configuration in asp.net core applications is created with a builder pattern in a layered approach. Some layers include: - appsettings.json file - appsettings.[yourenvironment].json - environment variables - command line arguments You can add more layers to this, like azure keyvault. You should google for asp.net core and not specifically for Umbraco, because this is provided by the framework, not Umbraco.
Apparently if you prefix your environment variables with
ASPNETCORE_
or
DOTNET_
, they are picked up by the configuration
So in case of the database connection string, you should add an environment variable with the name
DOTNET_ConnectionStrings:UmbracoDbDSN
c
oh okay, I'll tryt hat
thanks man i did try the .env route as I saw it has a order of preference
but I think my issue was doing
DOTNET_ConnectionStrings__UmbracoDbDSN
instead of
DOTNET_ConnectionStrings:UmbracoDbDSN
d
This particular stack overflow question also mentions something about dockerfiles and environment variables. I know nothing about docker, but this may also be relevant? https://stackoverflow.com/questions/42572311/appsettings-json-for-net-core-app-in-docker
c
docker can read from .env no problem, was more about how to either override or programmitcally set db string, but i will try ur above suggestion when i get round to i!
23 Views