Open Closed

how to published correctly - appsettings.secrets.json leaks #4549


User avatar
0
cala created

Hi, we notice that the appsettings.secrets.json gets publish too - and deleting it cause a "ABP-LIC-0020". How to we prevent this sensitive information from deploying to our clients ? ( microsoft states that you should not use any secrets file outside the development process )

Beside, is there any documentation about how to publish abp correctly ? well the process is pretty much straight forward but the secret should not be contained in output. some advice about how to publish the migration project within the blazor project ( to prevent duplication of dll's ) and run it automaticly on blazor start would be great :)

Thanks

  • ABP Framework version: v6.0.2
  • UI type: Blazor
  • DB provider: EF Core
  • Tiered (MVC) or Identity Server Separated (Angular): no

10 Answer(s)
  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    You can safely delete files, We don't check licenses in production

    See: https://support.abp.io/QA/Questions/3999/license-error#answer-2481de64-16f7-6ff5-1166-3a077416ec17

    You can see the document to know how to avoid publishing the appsettings.secrets.json: https://learn.microsoft.com/en-us/dotnet/core/project-sdk/msbuild-props#copytopublishdirectory

    some advice about how to publish the migration project within the blazor project ( to prevent duplication of dll's ) and run it automaticly on blazor start would be great :)

    Are you talking about database migrations?

    You can use the execute database migrations on production environments: https://docs.abp.io/en/commercial/latest/startup-templates/application/solution-structure#dbmigrator-project

  • User Avatar
    0
    cala created

    the application does NOT start if you delete appsettings.secrets.json

    2023-02-16 09:33:12.136 +01:00 [ERR] ABP-LIC-0020 - License code not found! Ensure that your appsettings.json or appsettings.secrets.json has "AbpLicenseCode" key with your license code. 2023-02-16 09:33:12.136 +01:00 [ERR] ABP-LIC-ERROR - License check failed for 'Volo.Abp.Identity.Pro.Domain-v6.0.2.0'.

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    the application does NOT start if you delete appsettings.secrets.json

    We don't check licenses in production but but development

  • User Avatar
    0
    cala created

    can you provide some advice what went wrong if the published release version still require the appsettings.secrets.json ? double checked our publishing routine but everything looks good.

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    I think you are still running in the development environment.

    You can check the Microsoft document:https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/environments?view=aspnetcore-7.0

  • User Avatar
    0
    cala created

    no - its production

    added Log.Information( "start as " + builder.Environment.EnvironmentName );

    here is the log

  • User Avatar
    0
    alper created
    Support Team Director

    AbpLicenseCode must be in your appsettings (even on production)

  • User Avatar
    0
    cala created

    so you do check the license even in production - you stated you dont do this a couple of times. so this is a bug isnt it ?

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    I misunderstood the message earlier.

    And I ask the ABP team:

    • In the development environment we will check the license online (remote license server)
    • In the Production environment we will check the license offline(local)

    So, the AbpLicenseCode need always exists

  • User Avatar
    0
    alper created
    Support Team Director

    if you don't want to write the AbpLicenseCode to appsettings.secret.json there are several other ways to store this data. We are using ASP.NET Configuration so you can set it as environment variable https://learn.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-7.0

Made with ❤️ on ABP v9.1.0-preview. Updated on December 12, 2024, 07:15