Using secrets.json in IIS

In the world of software development, safeguarding sensitive data is paramount, especially when it comes to configuration settings that may include passwords, API keys, and connection strings. ASP.NET Core provides a robust mechanism for managing such sensitive data during development through the use of a secrets.json file. This feature is part of a broader configuration system that allows developers to store and retrieve application settings in a variety of ways, including environment variables, command-line arguments, and external files.

The secrets.json file is a secure and convenient place to store confidential information that is specific to your development environment. It is not checked into source control, which means your secrets are not exposed when your code is shared or published. Instead, the secrets.json file resides in a system-protected user profile folder on your machine, keeping your secrets outside your main source tree avoiding that you accidently check-in and share secrets .

This works great when working on your local system and using Kestrel.

Here is an example controller:

	using Microsoft.AspNetCore.Mvc;
	namespace SecretsInIIS.Controllers
	{
	[ApiController]
	[Route("[controller]")]
	public class MessageController : ControllerBase
	{
	private readonly IConfiguration _configuration;
	public MessageController(IConfiguration configuration)
	{
	_configuration = configuration;
	}
	// GET /Message
	[HttpGet(Name = "GetMessage")]
	public string Get()
	{
	var secretMessage = _configuration["SecretMessage"];
	return secretMessage ?? "Secret not found";
	}
	}
	}

view raw MessageController.cs hosted with ❤ by GitHub

And the secrets.json file I’m using:

	{
	"SecretMessage": "hello world"
	}

view raw secrets.json hosted with ❤ by GitHub

This works as expected when using Kestrel:

However when I reconfigure my project to use IIS, the secrets file is no longer found and I get an error message back ("secret not found"):

I found multiple solutions online but the easiest one is to have the secrets.json at the root of your project. 

Now the secret is resolved correctly during development.

Of course now don’t forget to explicitly exclude this file from source control by updating your gitignore file:

	# Ignore secrets.json file
	secrets.json

view raw .gitignore hosted with ❤ by GitHub

More information

Can you keep a secret?

Running in IIS · Issue #16328 · dotnet/AspNetCore.Docs

Debugging Under IIS · Issue #30378 · dotnet/AspNetCore.Docs