EngineBay.DataProtection 2.0.3

EngineBay.DataProtection

DataProtection module for EngineBay published to EngineBay.DataProtection on NuGet.

About

Registering and configuring this module will add a DataProtectionProvider to your service collection, making it available for dependency injection. You can use this provider to encrypt and decrypt text, which is useful when storing sensitive data.

For any fields that you wish to be encrypted while stored in your database, the DataProtectionProvider should be used to encrypt before storing, and decrypt when you wish to access the value. This means that the data protection mechanism is agnostic to which database system you use.

Warning: Whilst this module provides the options to store your encryption keys in a local files system or on a redis server, it cannot back up your keystore. Ensure you have a secure backup strategy. If you lose the keys, you will lose access to the data.

Read more about data protection here.

Usage

If the module is registered, accessing it in any other module's class is as simple as normal dependency injection: specify IDataProtectionProvider dataProtectionProvider as a constructor parameter.

To use this, you will need to create a protector and use it to protect or unprotect your desired strings.

To encrypt:

var dataProtector = dataProtectionProvider.CreateProtector("Reason for encrypting");
var encryptedMessage = dataProtector.Protect(message);

To unencrypt:

var dataProtector = dataProtectionProvider.CreateProtector("Reason for encrypting");
var message = dataProtector.Unprotect(encryptedMessage);

For an example of a model with a field that is stored encrypted at rest, see the EncryptedMessage field for SessionLog from EngineBay.ActorEngine.

Registration

This module cannot run on its own. You will need to register it in your application to use its functionality. See the Demo API registration guide.

Environment Variables

See the Documentation Portal.

Dependencies

• EngineBay.Core