Bits of .NET

🔐 Connection Strings Don’t Belong in Code

appsettings.json is checked into Git. Environment variables override config. Keep secrets out of source control.

📝 Using Environment Variables

// appsettings.json (defaults)
{
  "Database": {
    "ConnectionString": "Server=localhost;Database=dev"
  }
}

// Override with environment variable (Windows)
setx Database__ConnectionString "Server=prod;Database=prod"

// Linux/macOS
export Database__ConnectionString="Server=prod;Database=prod"

// Docker
docker run -e Database__ConnectionString="Server=prod;Database=prod" myapp

// Kubernetes
env:
- name: Database__ConnectionString
  value: "Server=prod;Database=prod"

// Read in code
var connectionString = Configuration["Database:ConnectionString"];

🎯 Multiple Environments

# Set environment
set ASPNETCORE_ENVIRONMENT=Production

# appsettings.Production.json will load

# User secrets (development only)
dotnet user-secrets init
dotnet user-secrets set "Database:ConnectionString" "Server=dev;Database=dev"

# Program.cs
var builder = WebApplication.CreateBuilder(args);
builder.Configuration.AddEnvironmentVariables();  // Already enabled

💡 Best Practices

• Never commit secrets to Git
• Use User Secrets for development
• Use Environment Variables for production
• Use Key Vault (Azure) or Secrets Manager (AWS) for sensitive data
• Prefix environment variables to avoid conflicts