安全存储Blazor Webassembly应用程序的应用程序机密

安全存储Blazor Webassembly应用程序的应用程序机密

问题描述:

我正在寻找在blazor webassembly应用程序中安全存储应用程序秘密的方法.我们可以在下面的MSDN文档中找到有关服务器端应用程序的详细信息.

I am searching on the way for safe storage of app secrets in blazor webassembly application. We can find details for Server Side application as in below MSDN documentation.

https://docs.microsoft.com/zh-cn/aspnet/core/security/app-secrets?view=aspnetcore-3.1&tabs=windows

我们如何在完全在客户端浏览器中运行的Blazor WebAssembly应用程序中使用这些秘密?

How can we use these kind of secrets for Blazor WebAssembly application which completely runs in client browser?

我的基本情况是,需要将密码,产品密钥(许可密钥)信息保留在应用程序代码之外.例如,我们将许可证加载到Program.cs的静态main方法中.

My basic scenario is, need to keep the passwords, product key (licensing key) information out of application code. For example, we load license inside the static main method of Program.cs.

https://i.stack.imgur.com/kCrV1.png

 public class Program
    {
        public static async Task Main(string[] args)
        {
            //want to access the product key here and need to avoid hardcoding
            SomeThirdPartyLibrary.RegisterLicense("product-key");
            var builder = WebAssemblyHostBuilder.CreateDefault(args);
            builder.RootComponents.Add<App>("app");

            builder.Services.AddTransient(sp => new HttpClient { BaseAddress = new Uri(builder.HostEnvironment.BaseAddress) });

            await builder.Build().RunAsync();
        }

我已经搜索了blazor的文档,但无法找到任何详细信息.请帮助我在Blazor Webassembly中找到解决此问题的推荐方法.

I have searched in documentation of blazor and not able to find any details for this. Please help me to find the recommended way resolving this in Blazor webassembly.

(对于服务器端,我们有多种选择,但是对于客户端,这是推荐的方式)

(for server-side, we have variety of option but for client-side what might be the recommended way)

如果将其存储在客户端上,那是不安全的.

If you store it on the client, it's not safe.

有一个实验性的MS nuget软件包声称可以通过加密来使存储安全-Microsoft.AspNetCore.ProtectedBrowserStorage

There is an experimental MS nuget package that claims to make the storage safe by encrypting it - Microsoft.AspNetCore.ProtectedBrowserStorage

您可以在此处阅读如何使用它

You can read how to use it here https://docs.microsoft.com/en-us/aspnet/core/blazor/state-management?view=aspnetcore-3.1