-
mike S
- PowerServer
- Saturday, 20 January 2024 07:39 PM UTC
Storing connection strings (really, the passwords and logins) and things like the JWT secret key should be set in something other than the c# code or the appsettings.
There are two main recommendations.
1. the most secure is to use something like azure keyvault and then access it at runtime (additional setup required of course such as setting up certs on the machine)
2. Use environment variables.
Environment variables are super easy to set in containers. In IIS on a windows server, it is something that takes more effort as you have to connect into the server. Also, it allows any process to see the environment variable. IIS supports setting the environment variables in the web.config file on a per application basis, which seems real nice. see: https://stackoverflow.com/questions/31049152/publish-to-iis-setting-environment-variable
Powerserver tends to want to overwrite the web.config (you can turn that off). Apparently, there is a similar file that could be set instead of web.config which should work around this problem.
The other thing is the storage of login/password in a database table for dynamic database connections. Does powerserver support getting that from an environment variable instead? Each database in the table has its own login/password, but would an environment variable work for all of them?
anyone else looking into setting things up this way?
Find Questions by Tag
Helpful?
If a reply or comment is helpful for you, please don’t hesitate to click the Helpful button. This action is further confirmation of their invaluable contribution to the Appeon Community.