Move the API-key pepper out of the deployed Server\appsettings.json on wonder-app-vd03 #171

New Issue

2026-11-06T15:24:55-05:00

dohertj2 commented

2026-11-06 15:24:55 -05:00

On the DEV box the API-key HMAC pepper lives in Server\appsettings.json inside the app directory, so an app-directory swap or overwrite can change or lose it. Losing or rotating the pepper invalidates every API key as completely as losing the auth store (a surviving store with a changed pepper is still a total outage). The QA boxes already keep the pepper in the NSSM environment (AppEnvironmentExtra).

Ask: move the pepper on vd03 to the service environment (as on QA) or the Secrets store, verifying the value is unchanged by hash prefix only (never print it), then verify an authenticated round-trip. Verify still open first — this was recorded as a deliberately-not-changed residual after the 2026-08-09 store-path incident.

Related, same box: ASPNETCORE_ENVIRONMENT is Staging live while the box-side install-service.bat sets Production, so a reinstall silently changes it (see the GLAuth TLS issue for why Production is currently not usable).

Source: scadaproj auto-memory wonder-upgrade-program.md (residual: "API-key pepper still in Server\appsettings.json"); repo appsettings.json only names the config key (PepperSecretName), not the value.

On the DEV box the API-key HMAC pepper lives in `Server\appsettings.json` inside the app directory, so an app-directory swap or overwrite can change or lose it. Losing or rotating the pepper invalidates every API key as completely as losing the auth store (a surviving store with a changed pepper is still a total outage). The QA boxes already keep the pepper in the NSSM environment (`AppEnvironmentExtra`). Ask: move the pepper on vd03 to the service environment (as on QA) or the Secrets store, verifying the value is unchanged by hash prefix only (never print it), then verify an authenticated round-trip. Verify still open first — this was recorded as a deliberately-not-changed residual after the 2026-08-09 store-path incident. Related, same box: `ASPNETCORE_ENVIRONMENT` is `Staging` live while the box-side `install-service.bat` sets `Production`, so a reinstall silently changes it (see the GLAuth TLS issue for why Production is currently not usable). Source: scadaproj auto-memory `wonder-upgrade-program.md` (residual: "API-key pepper still in Server\appsettings.json"); repo `appsettings.json` only names the config key (`PepperSecretName`), not the value.

dohertj2 added the area:auth priority:p2 type:deploy-gate migrated labels 2026-11-06 15:24:55 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/mxaccessgw#171