vNext / .NET5 config.json in wwwroot

Question

So far as i am thinking, it is now preferred to use config.json files to store configuration settings for you application, which is great. Love json format and find it easier to read.

Upon publishing my first vNext application though, i notice that the config.json file seems to publish into

approot/src/my_project/config.json

and my website are in a folder called wwwroot

My web server has multiple websites setup and each one used to have its own "app.config" file, which i could put in the website directory with settings specific to that website being run. But now i have 2 problems,

1. config.json is populated into the wrong directory

2. If i do put the config.json file into the wwwroot folder, then it can be accessed by the client via the browser. This is very dangerous.

Do i have to setup my web server to ignore requests for config.json if its in wwwroot, or am i missing something completely?

Answer 1

You should have a separate folder for each project. And never place a folder in wwwroot that you don't want served out. It could end up looking something like this:

/root
/root/Project1
/root/Project1/config.json
/root/Project1/wwwroot
/root/Project2
/root/Project2/config.json
/root/Project2/wwwwroot

Obviously, your structure doesn't have to exactly match. In general though, if you use separate directories to separate your projects, and don't put your config in your wwwroot, you'll be fine.

By the way, you may want to avoid having anything secret in the config.json file in the first place. You should be using source code control software, and you should avoid a situation where secret stuff gets checked in. Perhaps environment variables or the secrets API .

Answer 2

Thanks to mason for his answer about structuring websites on your webserver with regards to vNext, but there is also another option worth mentioning here, that is why i have add another answer.

As stated above, i have the config.json file in my project for developing, and to get the file i was using this in my Startup.cs file

public Startup(IApplicationEnvironment appEnv)
{
    var builder = new ConfigurationBuilder(appEnv.ApplicationBasePath.)
        .AddJsonFile("config.json")
        .AddEnvironmentVariables();

    Configuration = builder.Build();
}

This includes the file in the approot when publishing. Including it in the wwwroot is not an option either. So using the file structure, where you would have a folder containing both the approot and wwwroot folders, i changed the code to this, which works for development and publishing.

public Startup(IHostingEnvironment env)
{
    // configuration is in the folder above the wwwroot
    var builder = new ConfigurationBuilder(env.MapPath("..\\"))
        .AddJsonFile("config.json")
        .AddEnvironmentVariables();

    Configuration = builder.Build();
}

However, when you publish the code/site, the config.json file is still put in the approot folder. To get round this, you must can it to the project.json file, like so

"publishExclude": [
    "node_modules",
    "bower_components",
    "config.json",
    "**.xproj",
    "**.user",
    "**.vspscc"
],
"exclude": [
    "wwwroot",
    "config.json",
    "node_modules",
    "bower_components"
]

Now the file can be in the project root so you can save it too source control, it works when using IIS Express for developing and it is not published either.

Hope this help someone else