How to use the Data Protection API in ASP.NET Core

It includes built-in mechanisms for encryption and decryption, simplifying data protection tasks for developers.

The Data Protection API in ASP.NET Core uses both hashing and encryption to ensure security. Before diving deeper, it's important to first understand these two concepts.

Encryption and hashing are not the same

Encryption and hashing are both crucial security concepts but serve different purposes. Encryption is a two-way process that transforms data using a cryptographic algorithm, allowing it to be decrypted back with the correct key. The result is ciphertext, and it is primarily used to secure data in communication.

Hashing, on the other hand, is a one-way process that generates a unique message digest from text. The hashed data is always unique, and it's nearly impossible to reverse it back to the original text. Unlike encryption, which can be decrypted, hashing cannot be undone.

To use the Data Protection API in ASP.NET Core, install the Microsoft.AspNetCore.DataProtection package either through the NuGet package manager in Visual Studio or by running the appropriate command in the NuGet package manager console.

Install-Package Microsoft.AspNetCore.DataProtection -Version 9.0.0

Configure the Data Protection API in ASP.NET Core

The AddDataProtection extension method is used to configure the Data Protection API. It is typically called in the ConfigureServices method of the Startup class to set up data protection in an ASP.NET Core application.

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        // Add data protection services
        services.AddDataProtection();

        // Other services (e.g., MVC, Razor, etc.)
        services.AddControllersWithViews();
    }    
}

To store keys in the file system, you can configure the Data Protection API by specifying a directory where the keys should be persisted. This can be done by chaining the PersistKeysToFileSystem method to the AddDataProtection configuration, providing the desired file system path.

public void ConfigureServices(IServiceCollection services)
{
    // Configure data protection to persist keys in a custom directory
    services.AddDataProtection()
            .PersistKeysToFileSystem(new DirectoryInfo(@"C:\MyApp\Keys"));
    
    // Other service configurations (e.g., MVC, Razor, etc.)
    services.AddControllersWithViews();
}

By default, keys created and managed by the Data Protection API have a lifespan of 90 days. You can customize the key's lifetime by specifying a different duration. The following code snippet demonstrates how to configure a custom key lifetime.

public void ConfigureServices(IServiceCollection services)
{
    services.ConfigureDataProtection(options =>
    {
        // Persist keys to the specified directory
        options.PersistKeysToFileSystem(new DirectoryInfo(@"C:\MyApp\Keys"));

        // Set a custom key lifetime of 7 days
        options.SetDefaultKeyLifetime(TimeSpan.FromDays(7));
    });

    // Other service configurations (e.g., MVC, Razor, etc.)
    services.AddControllersWithViews();
}

You can protect keys with a certificate or store them in Azure Key Vault. To persist keys in Azure Key Vault, you need to configure the Data Protection API accordingly, as shown in the provided code snippet.

public void ConfigureServices(IServiceCollection services)
{
    services.AddDataProtection()
        .PersistKeysToAzureBlobStorage(new Uri(
         "Specify the Uri here"))
        .ProtectKeysWithAzureKeyVault
        ("keyIdentifier", "clientId", "clientSecret");
}

Encrypting data with the Data Protection API in ASP.NET Core

Once the Data Protection API is installed and configured, you can use it in your controller to protect data. The following code snippet demonstrates how to utilize the API for data protection within a controller.

public class HomeController : Controller
{
    private readonly IDataProtector _protector;

    public HomeController(IDataProtectionProvider provider)
    {
        // Create a protector instance specific to the controller's type
        _protector = provider.CreateProtector(GetType().FullName);
    }

    public IActionResult Index()
    {
        // Create a model to hold protected data
        var testModel = new TestModel();

        // Protect some data
        var protectedData = _protector.Protect("Sensitive Data");

        // Store the protected data in the model
        testModel.Data = protectedData;

        // Here you would persist the model to a database or file

        // Return the view
        return View(testModel);
    }

    // Other action methods can go here
}

In this example:

• The controller uses IDataProtectionProvider to create a data protector specific to the controller type.
• A piece of data ("Sensitive Data") is protected using the Protect method.
• The protected data is stored in the model (testModel.Data) and is ready to be persisted in a database or file.

When you run the application and set a breakpoint in the action method, you'll observe that the data has been encrypted.

You can create a helper class to simplify the process of encrypting and decrypting data using the Data Protection API. Below is an example of a reusable class that performs encryption and decryption, with the key passed as an argument to the Encrypt and Decrypt methods.

public class EncryptionHelper
{
    private readonly IDataProtectionProvider _dataProtectionProvider;

    public EncryptionHelper(IDataProtectionProvider dataProtectionProvider)
    {
        _dataProtectionProvider = dataProtectionProvider;
    }

    // Encrypts the provided text using the specified key
    public string EncryptData(string text, string customKey)
    {
        var protector = _dataProtectionProvider.CreateProtector(customKey);
        return protector.Protect(text);
    }

    // Decrypts the provided cipher text using the specified key
    public string DecryptData(string encryptedText, string customKey)
    {
        var protector = _dataProtectionProvider.CreateProtector(customKey);
        return protector.Unprotect(encryptedText);
    }
}

In this example:

• EncryptData and DecryptData methods are used to encrypt and decrypt data using a custom key passed as an argument.
• The helper class provides a straightforward, reusable way to handle encryption and decryption with the Data Protection API.

The Data Protection API is flexible and easy to use, making it a good option for securing short-term data such as query strings or cookies.