How we can secure the ClientID & ClientSecret inside our remote event receivers (Inside SharePoint Provider hosted app)

Question

I have developed many remote event receivers and host them inside azure web apps. now the web.config file inside those remote event receivers contain the ClientId & ClientSecret, as follow:-

 <appSettings file="custom.config">
    <add key="ClientId" value="e***7" />
    <add key="ClientSecret" value="h***g=" />
  </appSettings>

Now if a hacker or an end user found those values inside the project code, then the user can control all the sites, as when we register the remote event receivers we grant them full control on the site collection.. so any advice how we can secure those details? so if someone access the source code of the RER then she/he can not view those details?

Thanks

Answer 1

I would recommend that you use an Azure Key Vault to store these credentials. You can then either access the credentials directly via your code or by having a "dummy value" in your web.config that is replaced at runtime by your application. More information can be found here:

About Azure Key Vault

Tutorial: Use a managed identity to connect Key Vault to an Azure web app in .NET

Add Key Vault to your web application by using Visual Studio Connected Services

Using a managed identity to connect to a Key Vault

Once you have configured your web app to connect to the Key Vault, you will need to update your code to retrieve the secret from the Key Vault:

Using statements:

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Azure.Core;

Code to access the secret:

SecretClientOptions options = new SecretClientOptions()
    {
        Retry =
        {
            Delay= TimeSpan.FromSeconds(2),
            MaxDelay = TimeSpan.FromSeconds(16),
            MaxRetries = 5,
            Mode = RetryMode.Exponential
         }
    };
var client = new SecretClient(new Uri("https://<your-unique-key-vault-name>.vault.azure.net/"), new DefaultAzureCredential(),options);

KeyVaultSecret secret = client.GetSecret("<mySecret>");

string secretValue = secret.Value;

Await the response:

await context.Response.WriteAsync(secretValue);

Answer 2

The usual way for any .NET application is to use <appSettings file="Secrets.config" >[...]</appSettings>, and then exclude Secrets.config from source control using .gitignore. I tend to also provide a Secrets.Example.config file in source control, so future developers know what they need to collect.

Please be aware that the keys will remain in the history of the source repository, so it might be a good idea to invalidate the old keys after doing this.

It is also possible and sometimes better to set up Azure Key Vault, but this is can also be impractical/overkill in many situations.

Related article here.

Answer 3

Uses of client secret in production environment is not advisable.

Microsoft recommend to use SSL Certificate in production environment.

Here are the steps to use it.

1. Register the app in azure ad.
2. give the app permission as per your need.
3. Get SSL certificate or Self Signed Certificate with key protected.
4. Go to certificates & secrets section and upload it the certification. after this step you will get thumbprint.
5. Go to authentication section - add platform as website and add redirect URL of app.

After this -- Your code should acquire the token using certificate.

here are the steps for this.

1. Store your App ID, Tenant ID, Thumbprint in app config or azure key vault if you want more security.

2. Read the configurable from app config file or Azure Key Vault.

for configuration and use of Azure key vault use below link

configure azure key vault

3. How to validate and read the certificate from Local machine or Azure.

• define the scope,

>     //  “/.default”  indicate that _api permission is already defined in azure ad
>     var scopes = new string[] { "https://yourdomail.sharepoint.com/.default" };

• here is code to acquire the token.

 internal static async Task<string> GetApplicationAuthenticatedClient(string clientId, string certThumprint, string[] scopes, string tenantId)
    {
        X509Certificate2 certificate = GetAppOnlyCertificate(certThumprint);

        IConfidentialClientApplication clientApp = ConfidentialClientApplicationBuilder
                                        .Create(clientId)
                                        .WithCertificate(certificate)
                                        .WithTenantId(tenantId)

                                        .Build();

        AuthenticationResult authResult = await clientApp.AcquireTokenForClient(scopes).ExecuteAsync();
        string accessToken = authResult.AccessToken;
        return accessToken;
    }

You can refer this link for more details.

Configure SSL Certificate in code

You can refer below link how to Add a TLS/SSL certificate in Azure App Service.

TLS/SSL certificate in Azure App Service

Now coming to your questions.

Even if thumbprint is compromised or known to another person. He cannot use it or do any operation as he or she will require to install this certificate at his/her location with key. As Thumbprint is installed on server with private key and uploaded in azure ad which is much more secure.

Please accept the answer and upvote it if you are satisfied.