来自Azure网站的敏感数据

Question

I want to be able to get a connection string and email password safely from my web app on Azure. I currently have these values stored in my web.config file but understand this is a bad idea for security especially as I plan to opensource my site which would make this option unfeasible.

I am an Azure user and understand that you can access these values from the Azure portal however I am yet to be able to do so as my code fails with this error message:

The ConnectionString property has not been initialized.

I am using the following code in an attempt to gain access to my password (which is stored in the azure management app settings) and connection string (also available on Azure)

private string connectionString = Environment.GetEnvironmentVariable("SQLAZURECONNSTR_bitverifydb");
private string emailPassword = Environment.GetEnvironmentVariable("APPSETTING_Password");

Is something needed in web.config or am I doing something else wrong? How does one access such values from Azure properly?

Thanks for your help!

Answer 1

There was a recent new service called Azure Key Vault for this kind of scenario.

Basically , you create and manage the Keys/Secrets on this service and consume them on your apps as URIs.

Here is a quick guide to use it on a .Net Web app.