title: Securely encrypting / decrypting appsettings.json on server
body: <p>How do I protect the encryption key used to encrypt sensitive data in my web application's <code>appsettings.json</code>?</p>
  
  <p>I would like to protect sensitive data in my web application's config.</p>
  
  <p>In ASP.NET MVC4 applications we did it like this:</p>
  
  <ol>
  <li>Sensitive data (e.g. password in a connection string) is not added directly to <code>web.config</code> (or <code>web.prod.config</code> etc.), instead a placeholder variable is written.</li>
  <li>At deployment time, our deployment service (Octopus) would retrieve sensitive data from its secure storage and overwrite the variable in the <code>web.config</code>.</li>
  <li>The deployment process would then encrypt sensitive sections of the web.config using <code>aspnet_regiis.exe</code>.</li>
  </ol>
  
  <p>Now we are using ASP.NET Core the process we are following is a bit different.</p>
  
  <ol>
  <li><code>appsettings.json</code> holds the placeholder variables for sensitive data,
  similar to how web.config worked before.</li>
  <li>Deployment process substitutes placeholders with sensitive data from it's secure store as before.</li>
  <li><p>Instead of using <code>aspnet_regiis</code>, I believe I need to:</p>
  
  <p>a) make my own custom tool to encrypt parts of the <code>appsettings.json</code> file.</p>
  
  <p>b) make a custom configuration provider that can decrypt (all / parts of) the <code>appsettings.json</code></p></li>
  </ol>
  
  <p>What I don't understand is how to protect the encryption key used for (a) and (b). The old way leveraged the server's machine key to encrypt the file. </p>
  
  <p>The threat I am trying to mitigate is someone gaining access to the <code>appsettings.json</code> on the server and reading sensitive data out of it (e.g. database password etc.)</p>
  
  <p>I am also intrested in alternative ways to mitigate this threat and/or other problems with this approach in general.</p>