Skip to content

README.md

Latest commit

 

History

History
93 lines (71 loc) · 4.3 KB

README.md

File metadata and controls

93 lines (71 loc) · 4.3 KB
Raw

ASP.NET Core Data Protection with Redis Keystore Sample App

ASP.NET Core sample app illustrating how to make use of the Steeltoe DataProtection Key Storage Provider for Redis. Simplifies using a Redis or Valkey cache on Cloud Foundry for storing encrypted session state.

General pre-requisites

  1. Installed .NET 10 SDK

  2. Optional: Tanzu Platform for Cloud Foundry (optionally with Windows support) and one of the following service brokers:

    and Cloud Foundry CLI

Note

Versions of ASP.NET Core before v9 require that Lua scripting is activated, which is disabled by default on Cloud Foundry, so check your plan settings.

Running locally

  1. Start a Redis or Valkey docker container
  2. Run the sample 
    dotnet run

Upon startup, the app displays session information on the home page, something like the following:

Instance Index Session ID Session Value
N/A 3f609c90-fd11-19d9-c231-fa988071030f Example Protected Text - 865765ac-61d2-4ea5-b711-4b6c9123bc6e

Running on Tanzu Platform for Cloud Foundry

  1. Create a Redis service instance in an org/space

    cf target -o your-org -s your-space
cf marketplace
cf marketplace -e your-offering
    • When using Tanzu for Valkey on Cloud Foundry: 
      cf create-service p.redis your-plan sampleRedisDataProtectionService --wait
    • When using Tanzu Cloud Service Broker for Microsoft Azure: 
      cf create-service csb-azure-redis your-plan sampleRedisDataProtectionService --wait
    • When using Tanzu Cloud Service Broker for AWS: 
      cf create-service csb-aws-redis your-plan sampleRedisDataProtectionService --wait

  2. Deploy the app

    • From Source:

      cf push

    • From Binaries (required if deploying to Windows):

      dotnet publish -r win-x64 --self-contained
cf push -f manifest-windows.yml -p bin/Release/net10.0/win-x64/publish

    For either deployment option, monitor startup logs with: cf logs redis-data-protection-sample.

  3. Copy the value of routes in the output and open in your browser

  4. Scale up to multiple app instances

    cf scale redis-data-protection-sample --instances 2

  5. Wait for the new instance to start up.

Using the same browser session, refresh the page a couple more times. It may take a few tries to get routed to the second app instance. When this happens, you should see the Instance Index changing, while the Session ID and Session Value remain the same.

A couple things to note at this point about this app:

  • The app is using the Cloud Foundry Redis service to store session data. As a result, the session state is available to all instances of the app.
  • The session ID that is in the session cookie and the data that is stored in Redis is encrypted using keys that are now stored in the keyring, which is also stored in the Cloud Foundry Redis service. So when you scale the app to multiple instances, the same keyring is used by all instances and therefore the session data can be decrypted by any instance of the application.
  • For multiple app instances to share Redis data, ensure they have an identical name in the connection string in appsettings.json.

See the Official Steeltoe Security Documentation for more detailed information.