In lesson M2.4, the Order Book's settings moved from App.config to appsettings.json, and the lesson made a promise: If secrets were added, they would never belong in this file. They have been added since. The web app from lesson M5.1 needs credentials, the web API is supposed to sign in to Azure SQL, and the house rules of the example project forbid connection strings with a password in Git and in packages. This lesson cleans up: It clarifies what a secret even is, takes the password out of the database connection, puts the real secrets in Key Vault and, along the way, completes the driver switch that lesson M2.3 began. The basics of secrets in operation are in K3, module 3.3 (Security in operation).
What is a secret, anyway?
A secret is a value with which someone can prove their identity: a password, a key, a client secret. Identifiers are not secrets. The tenant ID and the client ID of a registration stand in appsettings.json in the examples of Microsoft's documentation. The Order Book's inventory looks like this:
| What | Secret? | Place |
|---|---|---|
| Tenant ID, client IDs, scopes of the API | no, identifiers | appsettings.json |
| Hourly rate, call-out fee, VAT rate | no | appsettings.json (lesson M2.4) |
| The Windows program's connection to LocalDB | no, Windows sign-in without a password | appsettings.json |
| Connection to Azure SQL with Microsoft Entra ID | no, no password in the string | appsettings.json per environment |
| Client secret of the web app (lesson M5.1) | yes | Key Vault in operation, user secrets in development |
| Access to further services (for example the blob storage from lesson M4.5) | first ask whether a managed identity is enough | managed identity, otherwise Key Vault |
The most important row is not in the table: The Windows program gets nothing at all. Microsoft's documentation on line-of-business programs with a protected API says: no database password, no client secret, no protected connection string in a desktop program, because anyone who has the program can get it out. The more forms call the API from lesson M4.2, the fewer connections the program needs, until it has none.