How to replace machinekey for asp.net core?

Question

My task is simple - to share cookies among servers in a farm

I know that old way using machine key doesn't work in asp.net core, but there is a DataProtection API

However, I cannot store keys in shared folder (it's default built-in behavior of DataProtection)

Is there any way to store key exchange data in configs? (like in old asp.net)

Answer 1

you can store the keys in a file system folder, but there are of course security concerns in doing so, however the concerns are similar as with storing a key in web.config.

The thing that is different is that there is not just one key like with machine key, the keys in data protection api expire after a given period and new keys are created when needed automatically. If you encrypt something with the data protection api and store it persisted in the database for example, you may need to decrypt it later using the expired keys

This example is storing the keys in a folder named dp_keys within the web app main folder.

string pathToCryptoKeys = Path.Combine(environment.ContentRootPath, "dp_keys");
        services.AddDataProtection()
            .PersistKeysToFileSystem(new System.IO.DirectoryInfo(pathToCryptoKeys));

Note that storing the keys in the file system is not the recommended approach. There is a powershell script in the docs that enables storing keys per application pool in the system registry. For Azure there is the Azure Key vault for storing the data protection keys.