Intro to AppSettings in .NET Core - Appsettings.json, secrets.json, and more

app settings are a huge deal in net core in fact they're such a big deal they often get overlooked you see microsoft has been a big effort to have great defaults for complex configurations app settings is a great example of this you can start using app settings with only a couple lines of code and yet there's so much content to cover in this topic i won't be able to cover all in this video actually that's why i haven't covered this topic on its own yet i wasn't sure how to get it done so why do an intro video to get you started on a path towards understanding app settings better but i hate to leave you there some of you might not need anything past the intro but for those of you who are building apps in production i want to be sure you're set to succeed so i took some time and did this right i create a four hour course called net core app settings in depth i covered everything i'll cover in this video plus i went to a lot more depth now normally this course will be 49 however we have three things to celebrate this week first we reach 10 000 customers on imtimcory.com that's huge my paid content helps fund my free content in case you hadn't noticed i've been able to do a lot more with a lot more quality recently that's because of those 10 000 people plus my patreon members plus those of you who watch ads in my videos speaking of you on youtube the second thing we're celebrating is hitting 175 000 subscribers that's a lot of people who've been helped by my content that number doesn't just happen it comes from you sharing the videos commenting on videos liking my videos even disliking and even just watching my videos they come out your participation pushes youtube to share my content more widely that helps more developers find the easier path to learning c sharp so thank you for all of your support however you give it because of you we can make a difference in people's lives i get messages all the time about lies that have been changed the better because they saw my videos that wouldn't be possible without your support now that's only two reasons why so we have three reasons to celebrate well the third reason isn't quite as dramatic but yesterday was my birthday so i decide because all of you have done so much for me to give you the birthday present this year from now until the end of september you can get my new course for just 29 that's 20 off now for those of you who are in europe or other countries that have vat that price is before vat is applied so you might your price might be a little bit different i put the link in the description this course with the coupon code applied if you don't see a discount use the coupon code celebrate 2020 at checkout remember this only runs the end of september if you're watching this video after that date i'm sorry you missed the sale but you can sign up for my mailing list where you won't miss another sale okay enough celebrating we have code to get to let's jump right into visual studio let's start off by creating a new project so new project and we're going to create a blazer app project so if we come down here to blazer app hit next let's call this app settings demo and the solution name will be intro to app settings hit create and we're going to create a blazer server app now dotnet core app settings works in razer pages it works in mvc it works in blazer server and it works in api so there's four project types for the web that it works for now it also works in console applications if you add a few configuration tweaks we saw how to do that a couple of videos ago we talked about sending the console opting more powerful and using app settings and so on then it can also be used in worker services rather gate with no extra configuration necessary and then for winform and wpf applications that are a dot-net core version you can also use these but you have to do a little extra configuration but it's there kind of hidden but it is there okay so net core has this built in you can use it in pretty much a net core project the one exceptionally blazer web assembly because it runs fully on the client so we can't use that okay so blazer servers we're going to use just because if and a lot of you have asked this question which which web application type should i use there is a lot there's a purpose for every different web application type and every application type has a reason for being i actually did a course on that called which asp.net core where we talked about which which version to use well if i have to default if i don't know a situation or if i'm going to assume some things then i'm going to assume that the the way to go is blazer server because blazer server is kind of like the the best of both worlds both server side and client side it's got a foot in each and yet does both well so by default i would choose this for web application over mvc over razer pages let's hit create and once it creates our project the first thing i do just to make sure that things are working that there's no problems we're going to hit run with is express so this is running it's going to make sure our application builds that it runs and then it looks normal and it does okay i'm zoomed into here a little bit so yours will look more like that but i like to zoom in for my demo so you can actually see the content a little better so there we go so our application's working it's running there's no problems it um we can even go to different pages increment the counter fetch the data and so on so that's our application that's how we get started but let's talk about what are app settings um and why are they so important so right down here we have app settings.json now notice the title of this this video is not intro to intro to appsettings.json it's not the same thing this is app settings because this appsettings.json file is one place where you can store settings for our application but there are actually by default five locations to store your data so that's just by default in the course i think we create 11 or 12 different locations with different types okay so uh we're not gonna get into all the detail because some of it's a little obscure for example ini files or xml files or custom json files or in-memory configurations a lot of stuff we cover in the course we just don't have time for today but we're going to talk about three of the five standard that are built into net core and all five are on by default that means if you've just been using apps.json this is the last fallback location that you can put data so there's four other places in front of this that you could have put data and override things so we're going to talk about that in that hierarchy in just a minute but appsettings.json we can put information here in a json structure so my setting this is my setting let's actually name it my setting from app settings.json okay and then what if we had a little more complex setting main setting and then object sub setting this is my sub setting from app settings dot json okay so this is these are settings you can have in your application now why would you use settings well your application is gonna get compiled once hopefully and so if you compile it once but yet you deploy it to different locations it is going to have to have different information depending on where it's deployed to for instance if you have a let's just say a sql server and it's going to be different based upon which machine you're on maybe it's the production sql server when it's deployed to the production system but it's on the development system you don't want to point to the production system so you want to point to the development sql server so that's a different connection string or maybe in development you don't want to send out emails but in production your application sends welcome emails to people as they sign up for your application well that would mean you'd have the mail server settings in production in development you'd have maybe a test mail server or something like that so those things change just from development to production but what about if you have a a server here where you're located and another one halfway around the world maybe they have two different databases they work with depending on which location they're at well now even your production systems have different configurations or different connection strings to work with and so you can't put this stuff in your source code because then it is not changeable without recompiling your application and then you have a nightmare with which did i compile this for is this compiled for production is it compiled for development is this for production a or production b oh no we gotta create production c well now you gotta change everything or the server went down or we had to upgrade our server a different one okay recompile the entire application that makes no sense beyond that there are security implications because if you put your your connection string or other sensitive data into your source code and compile that that can be decompiled it's actually quite easy especially for custom strings or um yeah strings because then it can't be obfuscated in any way so by having your settings in a separate settings file you can actually encrypt that setting and have it only uh injected into your application when it's needed and that's some more advanced stuff that we're not going to cover we'll talk about a little bit near the end but we're not going to cover in this video because again it's an intro we do cover it in the in-depth course i'm not trying to push this course what i'm saying is i'm just trying to let you know that yes there's more to more to dive in here but we will cover that in the full in-depth course okay so i have my my setting and my sub setting that my read into my application let's open up the index page let's get rid of the the survey even even the other stuff and we'll just say instead of hello world we're going to say app settings values and we'll create a couple of paragraph tags if you're not familiar with html and paragraph tags essentially it's just gonna wrap this in a paragraph so it's gonna have a space before and after it like you would see in a word document with paragraphs so we're gonna read a couple of values here first is going to be our our my setting and then a subsetting so my setting value and we'll put that there in just a minute and then let's copy this whole thing and we're going to say sub setting value so we're going to put the values for main setting and subsetting or my setting and subsetting here now to do this we have to actually ask for the settings so we're going to create a little code section here and in this code section we're going to create a couple of strings string my setting equals and you know let's just put equals empty string for now and then string sub setting same thing now let's put those values up here so my setting with an at in front which is the razor syntax and that allows us to put c sharp code into our html kind of mix the two together so we're going to have the value for my setting here and a value for subsetting here cool now we haven't loaded those values yet so they'll be empty but we will not load those values so the first thing i want to do is we need to bring in the configuration because that's where app settings are are set up and that's where we can access them now i haven't really show you this i show you this in the console app somewhat but let's quickly look over at program.cs and in here we have this create host builder inside create host builder we have the create default builder right here which if i mouse over this it tells me that's going to configure i configuration multiple times one's for environment variables then command line app settings.json with the and app settings.environment.json and user secrets and also environment variables down here and also command line arguments so multiple things it's doing in here it says environment variables twice because one of them is with the prefix.net underscore so it's doing a lot of stuff and that's where this all gets configured so we don't have to do anything to have all of that configuration done for us that's also a hierarchy what i mean by that is that there's five different pieces there's command line then there's um environment variables then there is user secrets then there is the um the environment specific app settings file and finally the appspace.json file the root one in that order we're gonna look for the settings we ask for and so it finds it in the first one command line then it's not going to look anywhere else and so on so that's what this sets up now we haven't had to do anything with that we just have to start asking or ask for the configuration so at inject i configuration now it's actually microsoft.extension.configuration eye configuration we'll say underscore config and this is our dependency injection now if you're in a class somewhere else let's go to data and we have the weather forecast service um yeah that works we have the weather forecast we have a weather forecast service well in here if i want configuration i would create a constructor ctor and tab twice create the constructor and ask for i configuration and notice it adds that using statement up here and i do the same thing config control dot to create and assign the field like so and oh move it down there that's weird i put it down here um but that created the the config we can then access anywhere inside this class to be able to access the configuration in this class asking for it from dependency injection but since we are we can say that's fine we're not actually using it since we are inside of a a blazer server page or a um a razer component then we do the at inject instead same concept as dependency injection to the constructor so we're injecting this eye configuration we're going to call it config now the one thing i'm going to do is i'm going to take this right here i don't want to have all of that so i ctrl x to cut it out but i don't have a using statement then for this well i can go over to imports.razer and add a using statement and that just allows us to have all of these all 10 of these using statements for every razor page at that level or lower if you've watched my blazer server video intro blazer server or of course my blazer server in-depth course you will be familiar with that and if you're not um this adds a using statement essentially to this page so now i configuration is recognized i can git config now let's actually use this to load these two values so down here in the at code section we're going to say protected override or say on initialized now i get questions often about this because it's technically executed twice on the opening page so when you first load this website it's going to and this is the the index page is the home page it is the the main page so this is the page that's gonna be rendered first when you call the website unless you put a um more the url than just the the main part of the url so if we call this page the first time it renders on this page it's going to call this on initialize twice and that freaks people out sometimes and the reason it freaks them out is because what if i'm doing data calls in here and this is the right place to do data calls you may say well outline did it called twice and i get that and in some cases that might not be what you want in which case you have two options you can either cache that data or what you can do is you can turn off server side rendering now turning off server side rendering does mean the user will have to wait for the page to be rendered on the client which is slower so that's why we render it twice we render it once in the server and then render a second time on the client to get the fresh data so the user gets the server side rendered page quickly and then in the background the page re-renders with the newest information on the client so the user sees the page more quickly and that's what that the purpose of that is so a little side note there i want to point that out if it does freak you out unless it's a really big problem leave it alone let it render twice but it's a really big problem then you have to make some choices about either writing some complex code or making your users experience more of a load time and that's not usually a good thing part of that too though is don't load everything on the first page maybe the web is different than desktops don't load everything only load pieces that you actually need so sorry a little bit of soapbox a little bit of rabbit trail there but let's get back to the uninitialized so let's say my setting equals underscore config dot get value this is a string value and we're going to ask for my setting there we go so that's all it's going to take to load from the configuration my setting now if you have come from a net framework background where you had app.config or web.config you might look at this and say oh this call right here is pulling from appsettings.json which technically it is but unlike the.net framework where that was really the only location we pulled from that will pull from appsettings.json after is looked in four other locations first and we'll see some of that overriding in just a minute but let's first just see this load on the page now before we get to that let's say my sub setting oops sub setting equals underscore config dot get value of type string now what's this gonna be do we have it in the main setting but then underneath mainstay this is an object inside there is a sub item called subsetting well how do we get that value well in this we say in c sharp we say main setting colon sub setting and that's how i get that value so let's run this and see an action so it's going to load those two values and hopefully display them on the page there you go my setting value is this is my this is my setting from appsettings.json the subsetting value is this is my subsetting from appsettings.json so we've seen now how to load from appsettings.json and that's really all there is to it you just ask for getvalue and the type of data you want to come back because it can be a bool it can be an int a double a decimal and so on in this case we're asking for strings now there is more nuance here in the fact we can actually load a whole section into a strongly typed object that's actually usually the recommended way of going instead of passing eye configuration around you pass a strongly typed object that traditionally is a singleton that has all your data from either a section or your entire settings file usually a section of your of your settings file now you can put that independent injection and you can pass that around we'll do that in the in-depth course but for this this is the the probably the most common way of getting one setting so you just need one setting boom there you go grab that one setting now connection strings have their own specific one let's add one more section here i want to show you this because connection string is a really common one so connection string value and let's put this up here and let's ask for the default connection string so connection string equals config dodge get connection string for default they may say well tim we don't have a default connection string you're correct and just just be clear i want to show this i've asked for something that's not there it doesn't crash it just says it wasn't there so i have no value therefore well it has value it's just not showing but it has no value to display there's no there's no um data to be displayed so let's create some data to put in here so we can display the default connection string app settings.json outside of main setting we'll put a comma where i say connection strings and this is an object now note that all of my properties whether they're the main property or whether they are a a property that represents a full object either way they're inside of double quotes that's important so all of these all these properties those keys will be inside of double quotes the values don't have to be if a value is a number then it would not be inside double quotes the same is true if it's a boolean okay inside connection strength this is important this is a special key in that you have to spell it correctly with the right casing so connection strings it's plural inside of here we can say default and the value is this is my connection string from app settings dot json now obviously that's not connection string but all the connection string really is when we get down to it is a string so where i use this in place of an actual connection string just we can see the value coming through and so we know when we override it so let's run this again i haven't changed anything else but i was asking for a default connection string and now we see that connection string value says this is my connection string from appsettings.json okay so we've now read from our configuration both in the just the root as well as a sub value as well as a connection string honestly if you stop there you've got a lot of information to use and you can make use of app settings in.net core but there's a lot more depth here and we're even though there's a lot more depth we're still going to scrap scratch the surface so let's go into a little more depth because there's a little bit more that i want to talk about as far as using this to your advantage you see not everything can go into appsettings.json if you work with a team even if you don't you should be using source control specifically you should use git now if you are not familiar with get i'd recommend you get used to it because it is the de facto standard for source control in the industry not just in net but across the board it's the number one source control management system on the planet it's free i have a video on this channel called i believe intro to get you can check that out it's about two hours where i go really in depth in getting started with with git and getting to know the commands because once you know the commands in the structure which it sounds a little scary it's actually a really powerful tool but if you're using source control then appsettings.json goes into source control that's a good thing from the perspective of all of your settings all of your configuration all that structure will be saved in case you have to back up or overwrite or change something it's not a good thing if you're trying to put sensitive data there now let's talk about what is sensitive data there's different kinds there's developer sensitive data for instance if i want to connect this application to my local sql server my local db i'd grab one of these databases let's just grab it doesn't matter which one um and let's open this up and go to properties and in here would be connection string right there i could copy that and i could paste that into my app settings okay that would be say i want to keep cut to myself it's not the same thing as secret because if you notice integrated security equals true i'm not have i'm not passing off a username and password in here and even if i did which i could i might develop a machine even if i put my username and password it'd be for my development sql server so not the end of the world if somebody else has it however this is not the same settings this is not the same connection string that my co-worker might have for the same application when they are developing it therefore i don't want to give this in or put this in a source control because then it overrides my co-workers setting and now they have to redo it or not download this file in order to make sure that they have their set setup for their machine so development settings aren't necessarily secret but they we do want to keep them to ourselves so that's one kind of secrecy and that's we're going to deal with today when we talk about user secrets but then the other type is production security when you're talking about putting an actual connection string in here that has a username and password to the production database that we probably don't want anybody to have access to maybe not even our developers and for that we want to deal with something a little bit more advanced like either azure app settings the environment variable override and other hosts do the same thing with environment variables and overriding those are usually i can't speak for every host but for azure i know that they are encrypted at rest and encrypted during transmission to your application and that only the people who have access to your production server setup will have access to those usernames and passwords if you want a step further azure key vault which also integrates with app settings it's just one more thing you add to app settings one more place to look azure key vault encrypts at rest encrypts during transmission and isn't even visible to your web server administrators it's super locked down and we're going to cover that in the in-depth course as well so that's kind of the the server side of things the production side but that's for the end of the road before that point we have things we want to keep separate at least whether it be our development server or our staging server our our qa server our testing server um those are things we want to keep separate but not necessarily secret so that's where two more types or two more places to look for settings come in in the first one if we expand app settings over here there's actually a file underneath it called appsettings.development.json this is only being used this is only used if your application is running in development mode now what is development mode and how do you know if you're running in it good question and the answer is actually not if you're running in visual studio it may seem that way but that's not what it means to be in development mode in the for this instead if you go to properties you expand properties you see launch settings.json you'll notice ias settings right here for is express and then also app settings.demo so is actually has a part up here and then part down here whereas app settings demo which is actually kestrel that has all the settings right in here so that's our two options here is express and app settings demo which is kestrel these are our two web servers in visual studio for development well for both of these we'll see environment variables and one environment variable is being set asp.net core underscore environment is development that's for both of them that's what's setting us up to be in development mode is that environment variable so with that being said we will look at appsettings.development.json before we look at app settings so if there is a setting in here it will override the setting in appsettings.json let me prove this to you let's grab just this setting my setting let's paste that we're gonna put a comma and paste it in here and we'll say this is from appsettings.development.json we haven't put any other setting here just that one let's run this application now notice this my setting this is my setting from appsettings.development.json the other two are still from appsettings.json but because we put that one setting in the appsetting.development.json file it overwrote this one now why is that valuable why is it like they have two different places one for development one for what seems like just a regular one well we're not always in development mode this file is probably one you share with your entire team see you check this in the source control probably it you can choose maybe you do maybe don't but probably you do and what this will be is it will override all the settings that might otherwise be something either sensitive or might configure your application the way that you would want to do for development for example sending email you don't want to do that in development now what i typically do is let's say for connection string i would probably blank this out i wouldn't have anything in here in appsettings.json but then in my development json i would have a value because that would be for my development server and probably a server that all of my developers would point to when they're developing against the central development system for when we publish to a development server that would be the settings we'd use so that's probably due but then what would happen is if we publish to production well in production we don't have this environment variably being set and if it's not set at all then by default it's production which means that we will not read from appssettings.development.json we would read from appsettings.production.json so here's the cool thing we could actually put a file on the server on the production server that is not in source control that is not seen by annual developers but that has some production settings in it and those would override appsettings.json so that might be a solution just create an app settings.production.json and put just the settings in there that need to be set that need to be sensitive now i mentioned that i would blank out connection strings in my app settings.json just leave the the default here is empty and then i'd change that for development for production for other environments but there is a point to having appsettings.json this fallback because some settings like maybe my setting we can have the same value for production for development for everything else because maybe it's something as simple as um how many days are in a week we need to define that for some reason in a setting file well no problem that doesn't need a change for development versus production if you really need to change it for testing purposes we could change that in app settings.development.json and not affect anything else okay so development overrides our app setting but only when this is marked as development let's just try taking this setting out entirely so is express does not have that environment variable remember i'm still overriding that first value well i'm actually not because it's not looking at appsettings.development.json anymore it's looking at app settings.production.json which we don't have and it's okay it says does we won't find it no problem just skip it now again we'll cover that in creating one of those files which is really easy just create the file name it appsettings.production.json you're good to go make sure it's copying over the output directory but we'll cover that in the full course as well so that's how you deal with app settings for development versus production you can create other ones like staging or pre-production and have settings for each of those different locations that allows you to take your source code the same source code and deploy it from a development server to a staging server to a pre-production server to a production server without changing any settings if you've raced them once you don't need to keep changing them you don't have the same settings that you then tweak every different location nope they're already set once and you can deploy to all different environments and it will work so that's a big deal benefit of app settings so i said that we'd probably check in this app settings.development.json into source control but that's still leaving the question of how about my local database you remember i said i might not want to have this in appsettings.json or even appsettings.development.json because it would affect my co-workers who have a different url or different path to their development database their local development database what we do then well that's where user secrets come in if you right click on your project and say manage user secrets it's going to create a new json file called secrets.json now how you access this file is by right-clicking and saying manage user secrets so that's how you get to it every time there isn't a shortcut over here on the right there isn't a file somewhere it's just that one setting and the reason why is because this file isn't stored with the rest of your project this is on your machine only it will not get checked into source control it can't be because it's not even in the same path it's somewhere totally different in fact you mouse over it notice it says users slash me which is my login name slash appdia slash roaming slash microsoft slash user secrets slash a good slash secrets.json so that's this file here this is where you put files that are specific to your machine so your local development stuff and that's for this specific app so it'll be a different secrets.json for a different app so in here i could instead of having this this section right here let's just grab just this one actually you know what let's grab both of them and put it into secrets.json now remember that i'm back in development mode so i should have i should have let's cut this out and make sure i should have the development.json appssettings.development.json overriding that first value again so remember or up here this is back to my setting of back to being from app settings.development.json which overrides the app settings.json value well if i put values in secrets.json and let's override two of them and i run this application again now this is from secrets.json and this is from secrets.json so notice that the secrets.json is higher up the food chain if you will from the app settings.development.json and from appsettings.json there's the hierarchy apps user secrets come before either those now console uh command line parameters and also environment variables or even above these two but are these three but this is the highest one we're going to talk about today because these are the common ones you're going to deal with so this is apps or secrets.json it's really for your local environment now i think very clear about something this is not encrypted this is a clear text file now don't try to encrypt it because it's not a point this is stored on your profile the only time you can have access to this file is if you're logged in as you therefore this is protected by windows just like any of your other documents if your other documents are unsecure that means that your login is unsecure you need to fix that but otherwise this is secure for your machine therefore you can put stuff in here that is local stuff it's stuff that is for local settings your local username password database your local configuration for your email server probably well as local host email servers that allows you to see the emails without actually sending any maybe your local settings for other configuration stuff this is not for corporate sensitive stuff because you shouldn't have that probably on your machine in clear text anyway that's where you use an azure key vault to store that stuff so this is for your local settings the app settings.development.json that's for your team development server development environment the app settings is for your overall application for things that don't need to be overridden or if they do you can still override them in the other settings but maybe by default they're not overwritten so like i said the seven days in a week that's probably standard for everything right but there may be a case we want to test to make sure that if you change that it didn't break everything well you would test that by overriding either in secrets.json or appsettings.development.json so that's how app settings works that's how you work with it this is this video mainly has focused on the the process for working in development and staging and testing it's not going into production stuff and i did that intentionally because for the most part you'll be working with development code once you get to the point where you might need to deploy it that's when you should already working in a team environment where you have a better handle on how to deal with the devops processes how to um inject new values or encrypted values in the ci cd pipeline or use the environment variables that are encrypted for azure app services or use key vault or something else like that like i said i've covered all of this for both development and production in my course there's a lot to cover there's a lot more we haven't gone into we haven't done custom files uh we haven't talked about how to do environment variables or command line settings or you know security on the production side all kind of good stuff so a lot more to go into but this gets you pretty much all the way there for building applications this is all you need to create a great robust system for storing your data that will change per environment or that might change more often than you rebuild your application so any kind of setting that your application has should probably pulled out and put into app settings because that way it allows your application to be configured or changed or tweaked without having to be rebuilt and that's what they're for fortunately we've gone from what we had in dot net framework which was okay with app.config and web.config to something that is amazing in app settings we have so much power here but it starts off so simple to use you just need to ask for that that i that i configuration and then say get value that's really have to get started but then as you go deeper you can have these different configurations for different environments and really grow and yeah the complexity grows a little bit but it's going to grow a little bit while your application's complexity grows a lot more like i said a big fan of app settings i think that microsoft has hit a home run here both with creating a system that is flexible and easy to configure and grow and make more complex really with a lot of different options including your own custom options where maybe you don't have a normal type of file you can still read it and put it into app settings but yet with all that complexity with all those different options you could do microsoft has chosen some great defaults it made it so easy to use that you just ask for it and then use it and that's it to get started so i really encourage you try us out play with it get to know it and don't just stop at appsettings.json really get to know the different environments because this is what sets apart the the hobbyist who never works with anybody else from the person who is ready to work with other developers who's ready to interview for a job who's ready to get in and start working in a a environment that is more than just you so thanks for watching if you want to go deeper in this i do have the app settings the net core app settings in depth course to check out remember it's it's uh on discount through the end of the month only so check that out quick if you're interested thanks for watching share like it give me a comment down below what your thoughts are and as always i am tim cory [Applause] [Music] you

Channel: IAmTimCorey

Views: 120,254

Keywords: .net, C#, Visual Studio, code, programming, tutorial, course, training, how to, tim corey, C# course, C# training, C# tutorial, asp.net, .net core, appsettings.json .net core, appsettings.json connection string, appsettings.json .net core 3.0, appsettings.json azure, appsettings.json vs appsettings.production.json, appsettings.json how to add, appsettings json transform, appsettings.json environment override, asp.net core

Id: _2_qksdQKCE

Length: 50min 36sec (3036 seconds)

Published: Mon Sep 21 2020