是否可以禁用 ASP.NET Core 中的数据保护加密？

Question

Initially in Startup.cs , We omitted the AddDataProtection() call entirely. When we tried deploying the app, we saw this:

System.Security.Cryptography.CryptographicException: The key {...} was not found in the key ring.
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
   at Microsoft.AspNetCore.Session.CookieProtection.Unprotect(IDataProtector protector, String protectedText, ILogger logger)
warn: Microsoft.AspNetCore.Session.SessionMiddleware[7]
      Error unprotecting the session cookie.

When I added services.AddData.AddDataProtection().SetApplicationName("MyAppName"); to ConfigureServices() , we now see after deploying

System.Exception: An error was encountered while handling the remote login. ---> System.Exception: Correlation failed.
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.Invoke(HttpContext context)
warn: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[15]
      '.AspNetCore.Correlation.OpenIdConnect.{SomeWeirdString}' cookie not found.

I googled around for quite a bit and it seems that the "correct" way to fix this is to consolidate the encryption keys with .PersistKeysToFileSystem() . Is there an alternative to this though? such as disabling the encryption/data protection altogether?

For some background, this app is one that we are in the last stages of migrating from ASP.NET to ASP.NET Core, and previously we stored our session states in Redis, with no encryption.

Answer 1

The data protection stack is required and is used to protect data in cookies, session state, temp data, etc. Data protection persists a key somewhere to encrypt and decrypt the data. There are several options to persist the keys - by default, the file system or registry is used. When hosting on an on-premises server in IIS or in Azure, it usually just works. For other deployment options, especially using containers, you usually have to perform some configuration. For instance, containers usually have ephemeral storage, so the encryption keys are lost after deploying a new container instance.

As you mentioned Redis, I suggest you look into the Redis key storage provider: https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-storage-providers?view=aspnetcore-2.2&tabs=visual-studio#redis

The following documentation resources are also a good read:

• General docs on ASP.NET Core Data Protection
• Configure ASP.NET Core Data Protection