ASP.NET Core Data Protection: Secure Your App's Secrets

using Microsoft.AspNetCore.DataProtection;

public class DataProtectionService
{
    private readonly IDataProtector _protector;

    public DataProtectionService(IDataProtectionProvider provider)
    {
        _protector = provider.CreateProtector("MyApp.Purpose.v1");
    }

    public string Protect(string plaintext)
    {
        return _protector.Protect(plaintext);
    }

    public string Unprotect(string protectedData)
    {
        try
        {
            return _protector.Unprotect(protectedData);
        }
        catch (CryptographicException ex)
        {
            // Handle decryption failure (e.g., tampered data)
            throw new InvalidOperationException("Data integrity check failed.", ex);
        }
    }
}

using Microsoft.AspNetCore.DataProtection;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo(@"C:\Keys")) // Persistent store
    .ProtectKeysWithDpapi() // Protect keys at rest (Windows only)
    .SetApplicationName("MyApplication"); // Isolate keys

var app = builder.Build();

app.Run();

using Microsoft.AspNetCore.DataProtection;
using Microsoft.Extensions.DependencyInjection;

builder.Services.AddDataProtection()
    .SetDefaultKeyLifetime(TimeSpan.FromDays(30)) // New key every 30 days
    .SetKeyEscrowSink(new MyKeyEscrowSink()); // Optional: escrow keys

// To revoke a key manually:
// var keyManager = serviceProvider.GetService<IKeyManager>();
// keyManager.RevokeKey(keyId, "Key compromised");

using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Mvc;

public class HomeController : Controller
{
    private readonly IDataProtector _protector;

    public HomeController(IDataProtectionProvider provider)
    {
        _protector = provider.CreateProtector("HomeController.Index.v1");
    }

    public IActionResult Index()
    {
        string sensitiveData = "user-email@example.com";
        string protectedData = _protector.Protect(sensitiveData);
        // Store protectedData in cookie, hidden field, etc.
        return View();
    }

    public IActionResult Decrypt(string protectedData)
    {
        try
        {
            string plaintext = _protector.Unprotect(protectedData);
            return Content("Decrypted: " + plaintext);
        }
        catch (CryptographicException)
        {
            return BadRequest("Invalid data.");
        }
    }
}

public IActionResult SetCookie()
{
    var protector = _provider.CreateProtector("Cookie.Email.v1");
    string email = "user@example.com";
    string protectedEmail = protector.Protect(email);

    Response.Cookies.Append("UserEmail", protectedEmail, new CookieOptions
    {
        HttpOnly = true,
        Secure = true,
        SameSite = SameSiteMode.Strict
    });
    return Ok();
}

public IActionResult GetCookie()
{
    if (Request.Cookies.TryGetValue("UserEmail", out string protectedEmail))
    {
        var protector = _provider.CreateProtector("Cookie.Email.v1");
        try
        {
            string email = protector.Unprotect(protectedEmail);
            return Content("Email: " + email);
        }
        catch (CryptographicException)
        {
            return BadRequest("Cookie tampered.");
        }
    }
    return NotFound();
}

using Microsoft.AspNetCore.DataProtection;

public class TokenService
{
    private readonly ITimeLimitedDataProtector _protector;

    public TokenService(IDataProtectionProvider provider)
    {
        _protector = provider.CreateProtector("Token.PasswordReset.v1")
            .ToTimeLimitedDataProtector();
    }

    public string GenerateToken(string userId, TimeSpan lifetime)
    {
        return _protector.Protect(userId, lifetime);
    }

    public string ValidateToken(string token)
    {
        try
        {
            return _protector.Unprotect(token);
        }
        catch (CryptographicException)
        {
            // Token expired or tampered
            return null;
        }
    }
}

using Microsoft.AspNetCore.DataProtection;
using Microsoft.Extensions.DependencyInjection;
using Xunit;

public class DataProtectionTests
{
    [Fact]
    public void ProtectAndUnprotect_RoundTrip_Success()
    {
        var services = new ServiceCollection();
        services.AddDataProtection()
            .PersistKeysToFileSystem(new DirectoryInfo(Path.GetTempPath()))
            .SetApplicationName("TestApp");
        var provider = services.BuildServiceProvider();
        var dataProtectionProvider = provider.GetRequiredService<IDataProtectionProvider>();
        var protector = dataProtectionProvider.CreateProtector("TestPurpose");

        string original = "sensitive data";
        string protectedData = protector.Protect(original);
        string decrypted = protector.Unprotect(protectedData);

        Assert.Equal(original, decrypted);
    }

    [Fact]
    public void Unprotect_TamperedData_Throws()
    {
        var services = new ServiceCollection();
        services.AddDataProtection();
        var provider = services.BuildServiceProvider();
        var dataProtectionProvider = provider.GetRequiredService<IDataProtectionProvider>();
        var protector = dataProtectionProvider.CreateProtector("TestPurpose");

        string protectedData = protector.Protect("test");
        // Tamper with the data
        char[] chars = protectedData.ToCharArray();
        chars[10] = 'X';
        string tampered = new string(chars);

        Assert.Throws<CryptographicException>(() => protector.Unprotect(tampered));
    }
}