Best way to hide values ​​for sessionState provider

Question

I am using the Redis cache Session State Provider in my MVC application. Of course, all the settings for the provider are in my Web.config. The application works if I just put Host and Key and all this is like simple strings, so it looks like this:

<sessionState mode="Custom" customProvider="MySessionStateStore"> <providers> <add type="Microsoft.Web.Redis.RedisSessionStateProvider" name="MySessionStateStore" host = "[HOST]" port = "6379" accessKey = "[KEY]" ssl = "false" throwOnError = "true" retryTimeoutInMilliseconds = "5000" databaseId = "0" applicationName = "TRAXProSurvey" connectionTimeoutInMilliseconds = "5000" operationTimeoutInMilliseconds = "1000" /> </providers> </sessionState> 

... where "[HOST]" and "[KEY]" instead of the actual values. But this is not entirely safe, is it? Is there any way to hide this information somehow?

I know about using application settings in Azure configuration - I actually use a pair for something else. But I do not find a way to use them here specifically. I can create an application configuration variable, but what is the way to access this value in sessionState? I tried using System.Configuration.ConfigurationManager.AppSettings ("[name]") - only that, with quotes and with single quotes.

Maybe I just encrypted Web.config .... I found that you can add "<" MSDeployEnableWebConfigEncryptRule "> true <'/ MSDeployEnableWebConfigEncryptRule'>" (without any single quotes) in .pubxml - but that doesn't work on Regular Azure sites

I also found articles / examples for encrypting Web.config sections using aspnet_regiis .... but this will not work in a web farm environment such as Azure, right?

So what are the other options (if any)? ... or is it just not possible? Thanks!

Answer 1

You can use the application settings to configure your Redis session state, as shown below.

As an example, we want to set host and accessKey in the application settings.

 <appSettings> <add key="SomeHostKey" value="actual host value" /> <add key="SomeAccessKey" value="actual access key" /> </appSettings> 

You can select any line as a "key" inside the application settings. You can set the application settings from the azure portal.

Now, use this key as a value in web.config, as shown below:

 <sessionState mode="Custom" customProvider="MySessionStateStore"> <providers> <add type="Microsoft.Web.Redis.RedisSessionStateProvider" name="MySessionStateStore" host = "SomeHostKey" port = "6379" accessKey = "SomeAccessKey" ssl = "false" throwOnError = "true" retryTimeoutInMilliseconds = "5000" databaseId = "0" applicationName = "TRAXProSurvey" connectionTimeoutInMilliseconds = "5000" operationTimeoutInMilliseconds = "1000" /> </providers> </sessionState> 

You can specify all the parameters for the application settings, if you want. You can provide several parameters for the application settings and remain at web.config as you wish. The session state provider will find if you provide the actual value or application key in web.config.