Store Secret Data in .NET Core Web App with Azure Key Vault
4.5 (2 ratings)
Instead of using a simple lifetime average, Udemy calculates a course's star rating by considering a number of different factors such as the number of ratings, the age of ratings, and the likelihood of fraudulent ratings.
45 students enrolled
Wishlisted Wishlist

Please confirm that you want to add Store Secret Data in .NET Core Web App with Azure Key Vault to your Wishlist.

Add to Wishlist

Store Secret Data in .NET Core Web App with Azure Key Vault

Store secret/sensitive data with Azure Key Vault, Azure App Settings and .NET Core User Secrets in Visual Studio 2015/17
4.5 (2 ratings)
Instead of using a simple lifetime average, Udemy calculates a course's star rating by considering a number of different factors such as the number of ratings, the age of ratings, and the likelihood of fraudulent ratings.
45 students enrolled
Created by Jonas Fagerberg
Last updated 6/2017
English
Current price: $10 Original price: $50 Discount: 80% off
5 hours left at this price!
30-Day Money-Back Guarantee
Includes:
  • 1 hour on-demand video
  • 2 Supplemental Resources
  • Full lifetime access
  • Access on mobile and TV
  • Certificate of Completion
What Will I Learn?
  • You will learn to store sensitive data, such as passwords, in a secure manner. You will use .NET Core User Secrets, Azure Project Settings and Azure Key Vault in combination with Active Directory to achieve this.
View Curriculum
Requirements
  • Have completed at least one MVC 5 beginner course
  • Have a good understanding of the C# language
Description

This is an exciting course that will teach you how to secure sensitive data, such as passwords and connection strings in a ASP.NET Core 1.1 Web API.

These are skills that you must master as a serious developer.

*** NEW CONTENT: The same course for ASP.NET Core 1.1 in Visual Studio 2017 has been added ***

In this course you will:

  • Register for an Azure subscription
  • Implement a .NET Core 1.1 Web API
  • Store sensitive data with User Secret Manager (secrets.json), which stays on the developer machine and won't be propagated to a source code repository like GitHub or TFS when the code is checked in.
  • Implement an Interface called ISecrets, which will be injected into the controller's constructor via Dependecy Injection. The values from the secrets.json file or the Azure App Settings can then be used from the controller.
  • Add an Azure Key Vault, where secret values are stored, protected by Azure Active Directory security.
  • Add an Azure Active Directory App Registration to secure the Key Vault. The Application Id and the App Registration secret key is used to access the Key Vault
  • Read values from the Key Vault using the Application Id, secret key and the Key Vault's value endpoints
  • Call the Web API in Azure using the Chrome application Postman and make sure that the secret Key Vault values are returned. Note that the secret values normally wouldn't be returned through the API, we do it here for educational purposes only.
Who is the target audience?
  • The ideal student for this course is a web developer that want to learn how to store sensitive data securely in web applications
  • Have an open mind and be eager to learn
Students Who Viewed This Course Also Viewed
Curriculum For This Course
+
Introduction
2 Lectures 03:37

An introduction to the course and the instructor.

Preview 01:52

+
Register with Azure
2 Lectures 00:24

In this lecture you will learn how to register for an Azure subscription.

How to register with Azure
00:17

In this lecture you will learn how to access the Azure portal.

Opening the Azure Portal
00:07
+
Building the Web API
4 Lectures 14:22

In this lecture we will create a .NET Core 1.1 Web API solution in Visual Studio 2015.

Preview 02:36

In this lecture we will add sensitive data to the secret.json file using the User Secrets Manager. Data stored in this file will not be persisted to a source code repository, which will happen if you for instance store the sensitive data in the application.json or the web.config file.

Add sensitive data to the secrets.json file using the User Secrets Manager
05:07

In this lecture we will use Dependency Injection to make the secret values available in the controller's constructor and subsequently from the Get action. Note that we only return the secret values in the Get action to show that we can fetch them. In a real life scenario you wouldn't return them from the Web API, you would only use them internally.

Use Dependency Injection to use the secret data from a controller's constructor
03:15

In this lecture we will add sensitive data to the Web API App Settings in Azure. These values will then be merged with the setting from the application.json during run-time. We will see that these values will be used instead of the secret.json values, which only are available locally on the developer's computer.

Add sensitive data to the Web API App Settings in Azure
03:24
+
Securing sensitive data using Azure Key Vault and Azure Active Directrory
4 Lectures 05:42

In this lecture we will create a Key Vault in Azure and then add sensitive/secret values to it.

Preview 01:24

In this lecture we will fetch the endpoints needed to read the values stored in the Key Vault.

Fetching Value Endpoints from the Key Valut
01:26

In this lecture you will learn how to set up an Active Directory App Registration, which is used to secure the Key Vault. A secret key will be created to use in conjunction with the Application Id when fetching values from the Key Vault.

Preview 01:59

In this lecture you will learn how to connect the Active Directory App Registration, from the previous video, with the Key Vault. This connection between the two will then add up to a secure vault where secret or sensitive information, such as passwords and connection strings, can be stored.

Connecting Azure AD App Registration with the Key Vault
00:53
+
Implementing the Key Vault in the Web API
4 Lectures 06:58

In this lecture we clean up the controller to make way for the Key Vault implementation. The secret keys and value endpoint will no longer be returned from the Get Action method, they will only be used in the constructor to fetch the values from the Key Vault.

Cleaning up the Controller
00:51

In this lecture we look at how you can implement an extension method that use the secret information from the secrets.json or the project settings in Azure to create a connection to the Key Vault that then can be used to fetch the secret/sensitive data.

Adding the GetKeyVault Extension Method
03:18

In this lecture we will fetch data from the Key Vault using the secret key, application id and the value endpoint. The values are returned in the Get action method and can be accessed through an HTTP request, which you will see in the next video.

Preview 01:44

In this lecture we make an HTTP call to the Web API in Azure using a Chrome tool called Postman.

Making an HTTP call to the Web API with Postman
01:05
+
Visual Studio 2017 version
14 Lectures 25:56
001 - Register Azure (2017)
00:17

002 - Open the Azure Portal (2017)
00:07

003 - Creating the WebAPI (2017)
02:28

004 - Adding User Secrets (2017)
04:22

005 - User Secrets Dependency Injection (2017)
03:15

006 - Project Setings in Azure Web App (2017)
03:09

007 - Creating the Key Vault and Adding Values (2017)
01:24

008 - Fetching Endpoints from the Key Vault (2017)
01:26

009 - Adding Azure Active Directory App Registration (2017)
01:59

010 - Connecting Azure AD App Registration with Key Vault (2017)
00:53

011 - Cleaning up the Controller (2017)
00:47

012 - Adding the GetKeyVault Extension Method (2017)
03:02

013 - Accessing the KeyVault (2017)
01:42

014 - Making an HTTP call to the Web API (2017)
01:05
About the Instructor
Jonas Fagerberg
4.2 Average rating
104 Reviews
789 Students
2 Courses
Professional Teacher, Developer and Consultant

Jonas started a company back in 1994 focusing on education in Micro­soft Office and the Microsoft operating systems. While studying at the university in 1995, he wrote his first book about Widows 95 as well as a number of course materials.

In the year 2000, after working as a Microsoft Office developer consult­ant for a couple of years, he wrote his second book about Visual Basic 6.0.

Between 2000 and 2004 he worked as a Microsoft instructor with two of the largest educational companies in Sweden. First teaching Visual Basic 6.0, and when Visual Basic.NET and C# were released he started teaching these languages as well as the .NET Framework. Teaching classes on all levels for beginner to advanced developers.

From the year 2005, Jonas shifted his career towards consulting once again, working hands on with the languages and framework he taught.

Fore the past two years he has been teaching C#, SQL Server Programming, Entity Framework and MVC 5 to students at a vocational college.

Jonas wrote his third book C# programming aimed at beginners to intermediate developers in 2013 and in 2015 his fourth book C# for beginners - The Tactical Guide was published. Jonas has also produced a 24h+ video course called. In July 2016 his latest book ASP.NET MVC 5 - How to build a membership website will be released on Amazon which this video course is based on.