Events
Power BI DataViz World Championships
Feb 14, 4 PM - Mar 31, 4 PM
With 4 chances to enter, you could win a conference package and make it to the LIVE Grand Finale in Las Vegas
Learn moreThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
ASP.NET Core provides a cryptographic API to protect data, including key management and rotation.
Web apps often need to store sensitive data. The Windows data protection API (DPAPI) isn't intended for use in web apps.
The ASP.NET Core data protection stack was designed to:
<machineKey>
element in ASP.NET 1.x - 4.x.I need to persist trusted information for later retrieval, but I don't trust the persistence mechanism. In web terms, this might be written as I need to round-trip trusted state via an untrusted client.
Authenticity, integrity, and tamper-proofing is a requirement. The canonical example of this is an authentication cookie or bearer token. The server generates an I am Groot and have xyz permissions token and sends it to the client. The client presents that token back to the server, but the server needs some kind of assurance that the client hasn't forged the token.
Confidentiality is a requirement. Since the persisted state is trusted by the server, this state could contain information that shouldn't be disclosed to an untrusted client. For example:
Isolation is a requirement. Since modern apps are componentized, individual components want to take advantage of this system without regard to other components in the system. For instance, consider a bearer token component using this stack. It should operate without any interference, for example, from an anti-CSRF mechanism also using the same stack.
Some common assumptions can narrow the scope of requirements:
ASP.NET Core data protection is an easy to use data protection stack. It's based on the following principles:
The data protection APIs aren't primarily intended for indefinite persistence of confidential payloads. Other technologies, such as Windows CNG DPAPI and Azure Rights Management are more suited to the scenario of indefinite storage. They have correspondingly strong key management capabilities. That said, the ASP.NET Core data protection APIs can be used for long-term protection of confidential data.
The data protection system provides APIs that target three main audiences:
The consumer APIs target application and framework developers.
I don't want to learn about how the stack operates or about how it's configured. I just want to perform some operation with high probability of using the APIs successfully.
The configuration APIs target app developers and system administrators.
I need to tell the data protection system that my environment requires non-default paths or settings.
The extensibility APIs target developers in charge of implementing custom policy. Usage of these APIs is limited to rare situations and developers with security experience.
I need to replace an entire component within the system because I have truly unique behavioral requirements. I'm willing to learn uncommonly used parts of the API surface in order to build a plugin that fulfills my requirements.
The data protection stack consists of five packages:
Microsoft.AspNetCore.DataProtection.Abstractions contains:
If the data protection system is instantiated elsewhere and you're consuming the API, reference Microsoft.AspNetCore.DataProtection.Abstractions
.
Microsoft.AspNetCore.DataProtection contains the core implementation of the data protection system, including:
To instantiate the data protection system, reference Microsoft.AspNetCore.DataProtection
. You might need to reference the data protection system when:
Microsoft.AspNetCore.DataProtection.Extensions contains additional APIs which developers might find useful but which don't belong in the core package. For instance, this package contains:
Microsoft.AspNetCore.DataProtection.SystemWeb can be installed into an existing ASP.NET 4.x app to redirect its <machineKey>
operations to use the new ASP.NET Core data protection stack. For more information, see Replace the ASP.NET machineKey in ASP.NET Core.
Microsoft.AspNetCore.Cryptography.KeyDerivation provides an implementation of the PBKDF2 password hashing routine and can be used by systems that must handle user passwords securely. For more information, see Hash passwords in ASP.NET Core.
ASP.NET Core provides a cryptographic API to protect data, including key management and rotation.
Web apps often need to store sensitive data. The Windows data protection API (DPAPI) isn't intended for use in web apps.
The ASP.NET Core data protection stack was designed to:
<machineKey>
element in ASP.NET 1.x - 4.x.I need to persist trusted information for later retrieval, but I don't trust the persistence mechanism. In web terms, this might be written as I need to round-trip trusted state via an untrusted client.
Authenticity, integrity, and tamper-proofing is a requirement. The canonical example of this is an authentication cookie or bearer token. The server generates an I am Groot and have xyz permissions token and sends it to the client. The client presents that token back to the server, but the server needs some kind of assurance that the client hasn't forged the token.
Confidentiality is a requirement. Since the persisted state is trusted by the server, this state could contain information that shouldn't be disclosed to an untrusted client. For example:
Isolation is a requirement. Since modern apps are componentized, individual components want to take advantage of this system without regard to other components in the system. For instance, consider a bearer token component using this stack. It should operate without any interference, for example, from an anti-CSRF mechanism also using the same stack.
Some common assumptions can narrow the scope of requirements:
ASP.NET Core data protection is an easy to use data protection stack. It's based on the following principles:
The data protection APIs aren't primarily intended for indefinite persistence of confidential payloads. Other technologies, such as Windows CNG DPAPI and Azure Rights Management are more suited to the scenario of indefinite storage. They have correspondingly strong key management capabilities. That said, the ASP.NET Core data protection APIs can be used for long-term protection of confidential data.
The data protection system provides APIs that target three main audiences:
The consumer APIs target application and framework developers.
I don't want to learn about how the stack operates or about how it's configured. I just want to perform some operation with high probability of using the APIs successfully.
The configuration APIs target app developers and system administrators.
I need to tell the data protection system that my environment requires non-default paths or settings.
The extensibility APIs target developers in charge of implementing custom policy. Usage of these APIs is limited to rare situations and developers with security experience.
I need to replace an entire component within the system because I have truly unique behavioral requirements. I'm willing to learn uncommonly used parts of the API surface in order to build a plugin that fulfills my requirements.
The data protection stack consists of five packages:
Microsoft.AspNetCore.DataProtection.Abstractions contains:
If the data protection system is instantiated elsewhere and you're consuming the API, reference Microsoft.AspNetCore.DataProtection.Abstractions
.
Microsoft.AspNetCore.DataProtection contains the core implementation of the data protection system, including:
To instantiate the data protection system, reference Microsoft.AspNetCore.DataProtection
. You might need to reference the data protection system when:
Microsoft.AspNetCore.DataProtection.Extensions contains additional APIs which developers might find useful but which don't belong in the core package. For instance, this package contains:
Microsoft.AspNetCore.DataProtection.SystemWeb can be installed into an existing ASP.NET 4.x app to redirect its <machineKey>
operations to use the new ASP.NET Core data protection stack. For more information, see Replace the ASP.NET machineKey in ASP.NET Core.
Microsoft.AspNetCore.Cryptography.KeyDerivation provides an implementation of the PBKDF2 password hashing routine and can be used by systems that must handle user passwords securely. For more information, see Hash passwords in ASP.NET Core.
ASP.NET Core feedback
ASP.NET Core is an open source project. Select a link to provide feedback:
Events
Power BI DataViz World Championships
Feb 14, 4 PM - Mar 31, 4 PM
With 4 chances to enter, you could win a conference package and make it to the LIVE Grand Finale in Las Vegas
Learn moreTraining
Certification
Microsoft Certified: Information Protection and Compliance Administrator Associate - Certifications
Demonstrate the fundamentals of data security, lifecycle management, information security, and compliance to protect a Microsoft 365 deployment.
Documentation
Get started with the Data Protection APIs in ASP.NET Core
Learn how to use the ASP.NET Core data protection APIs for protecting and unprotecting data in an app.
Key storage providers in ASP.NET Core
Learn about key storage providers in ASP.NET Core and how to configure key storage locations.
Data Protection key management and lifetime in ASP.NET Core
Learn about Data Protection key management and lifetime in ASP.NET Core.