如何加密.NET Core中的App.config文件？

Question

我创建了一个新的 .NET Core 2.1 控制台项目。我添加了 Config.xml：

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <connectionStrings>
      <add name="MyLocalSQLServer" connectionString="Initial Catalog=aspnetdb;data source=localhost;Integrated Security=SSPI;" providerName="System.Data.SqlClient"/>
  </connectionStrings>
</configuration>

在Program.cs中：

class Program
{
    static void Main(string[] args)
    {
        Console.WriteLine(ConfigurationManager.ConnectionStrings["MyLocalSQLServer"]);            
    }
}

使用aspnet_regiis，我加密了配置文件：

RENAME "C:\repos\ConsoleApp7\bin\Debug\netcoreapp2.1\ConsoleApp.dll.config" web.config
aspnet_regiis -pef "connectionStrings" "C:\repos\ConsoleApp\bin\Debug\netcoreapp2.1"
RENAME "C:\repos\ConsoleApp7\bin\Debug\netcoreapp2.1\web.config" ConsoleApp.dll.config

最后，我运行了该应用程序：

dotnet "C:\repos\ConsoleApp7\bin\Debug\netcoreapp2.1\ConsoleApp.dll"

我收到错误：

Unhandled Exception: System.Configuration.ConfigurationErrorsException: 
 Failed to decrypt using provider 'RsaProtectedConfigurationProvider'. 
 Error message from the provider: Operation is not supported on this platform. 
 ---> System.PlatformNotSupportedException: Operation is not supported on this platform.
   at System.Configuration.RsaProtectedConfigurationProvider.Decrypt(XmlNode encryptedNode)
   at System.Configuration.ProtectedConfigurationSection.DecryptSection(String encryptedXml, ProtectedConfigurationProvider provider)
   at System.Configuration.BaseConfigurationRecord.DecryptConfigSection(ConfigXmlReader reader, ProtectedConfigurationProvider protectionProvider)
   --- End of inner exception stack trace ---
   at System.Configuration.BaseConfigurationRecord.EvaluateOne(String[] keys, SectionInput input, Boolean isTrusted, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentResult)
   at System.Configuration.BaseConfigurationRecord.Evaluate(FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentResult, Boolean getLkg, Boolean getRuntimeObject, Object& result, Object& resultRuntimeObject)
   at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object& result, Object& resultRuntimeObject)
   at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object& result, Object& resultRuntimeObject)
   at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object& result, Object& resultRuntimeObject)
   at System.Configuration.BaseConfigurationRecord.GetSection(String configKey)
   at System.Configuration.ConfigurationManager.GetSection(String sectionName)
   at System.Configuration.ConfigurationManager.get_ConnectionStrings()
   at ConsoleApp7.Program.Main(String[] args)

此技巧可以使用旧的 .NET Framework 加密 app.config，但 .NET Core 不支持它。

这样做的目的是测试从 .NET Framework 到 .NET Core 的迁移。

如何在 .NET Core 中加密 app.config？

Answer 1

正如“Off The Gold”所回答的那样，.NET Core 和 .NET 5+ 不支持RsaProtectedConfigurationProvider

但是我使用DataProtectionConfigurationProvider (DPAPI)在 .NET 7.0 中工作

这是一个有效的 encrypt.bat 文件：

set mypath=%cd%
rename "app.config" "web.config"

cd "C:\Windows\Microsoft.NET\Framework64\v4.0.30319"
aspnet_regiis.exe -pef "appSettings" "%mypath%" -prov "DataProtectionConfigurationProvider"
aspnet_regiis.exe -pef "connectionStrings" "%mypath%" -prov "DataProtectionConfigurationProvider"

cd "%mypath%" 
rename "web.config" "app.config" 

pause