Why should I use User secrets only in the Development environment?

Question

I have to save keys out of project and repository. For this, I want to use User secrets. But it is written there,

Call AddUserSecrets only when the app runs in the Development environment, as shown in the following example

And I can't understand or find a cause. Why can't I use it in the Production environment?

Answer 1

You can find it in the link you provided to the User Secrets documentation:

The Secret Manager tool doesn't encrypt the stored secrets and shouldn't be treated as a trusted store. It's for development purposes only. The keys and values are stored in a JSON configuration file in the user profile directory.

Answer 2

I think the short answer is that you probably could if you wanted to but that it is not what it is intended for.

My understanding is that the primary purpose of User Secrets is to keep credentials out of source control. In the days before GitHub and the cloud, most developers just stuck any and all credentials in the web.config and it was mostly ok. Then lots of people started using public repositories and AWS and all of a sudden https://www.zdnet.com/article/trufflehog-high-entropy-key-hunter-released-to-the-masses/

There are now a great many different tools out there for managing secrets, which one best suits your needs is a much harder question, but you could consider:

• Are you using access controlled source control?
• Are you cloud or on-prem for build and deploy?
• Who has read access to the live servers?
• How sensitive is the data you are storing?
• What other applications are running on the server?

I was just poking around in the CreateDefaultBuilder method and found this, which is perhaps relevant:

if (hostingEnvironment.IsDevelopment())
{
    Assembly assembly = Assembly.Load(new 
              AssemblyName(hostingEnvironment.ApplicationName));

    if (assembly != (Assembly) null)
          config.AddUserSecrets(assembly, true);
 }

Obviously you don't have to use the default version and you could add secrets for all the environments, but there it is.