OutWit.Shared.Secrets.Provider.File 1.0.0

.NET 8.0 This package targets .NET 8.0. The package is compatible with this framework or higher. 
dotnet add package OutWit.Shared.Secrets.Provider.File --version 1.0.0
                    


                    

                
NuGet\Install-Package OutWit.Shared.Secrets.Provider.File -Version 1.0.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="OutWit.Shared.Secrets.Provider.File" Version="1.0.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="OutWit.Shared.Secrets.Provider.File" Version="1.0.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="OutWit.Shared.Secrets.Provider.File" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add OutWit.Shared.Secrets.Provider.File --version 1.0.0
                    


                    

                
#r "nuget: OutWit.Shared.Secrets.Provider.File, 1.0.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package OutWit.Shared.Secrets.Provider.File@1.0.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=OutWit.Shared.Secrets.Provider.File&version=1.0.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=OutWit.Shared.Secrets.Provider.File&version=1.0.0
                    


                            Install as a Cake Tool

OutWit.Shared.Secrets.Provider.File

The explicitly-labelled file fallback for OutWit.Shared.Secrets.Providers — for deployments where no OS credential store is reachable: containers, session-less Linux services. Never selected automatically. Configuration names this provider; a store that silently degrades is worse than one that fails, because the degradation is invisible exactly when it matters.

What it does

  • One file per key — {key with '/'→'.'}-{hash8}.wsecret — under a directory you name; SecretStoreFile.MapFileName(key) computes the name.
  • Owner-only permissions applied at creation and verified by reading them back: 0600 on POSIX; on Windows an explicit non-inherited DACL naming only the owning account, part of the create call itself. Creating a file and hoping the parent directory's ACL is sane is how a ProgramData subtree ends up letting any authenticated user replace a credential.
  • Atomic replace: temp file in the same directory, write-through flush, then rename over. A crash mid-rotation leaves the old secret or the new one — never neither, never half.
  • On Windows the payload is protected with DPAPI machine scope (entropy bound to the key), and Description.Protection says FileWithPlatformKey. Elsewhere there is no platform key and the description says FileOnly — honestly. A host that requires better refuses to run on it.
services.AddSingleton<ISecretStore>(new SecretStoreFile(new SecretStoreFileOptions
{
    DirectoryPath = "/var/lib/myservice/secrets"
}));

// and log what you got:
logger.LogInformation("Secret store: {Description}", store.Description);

What this does not defend against

The same list as the abstractions README, and on FileOnly one more thing: anyone who can read the file can read the secret — the ACL is the whole defence. It does not defend against an administrator; an attacker running as the owning account; an offline attack on a stolen disk or image (the DPAPI machine key travels with the image); cloning. Keep anything stored here centrally revocable.

Product Compatible and additional computed target framework versions.
.NET net8.0 is compatible.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed.  net9.0 is compatible.  net9.0-android was computed.  net9.0-browser was computed.  net9.0-ios was computed.  net9.0-maccatalyst was computed.  net9.0-macos was computed.  net9.0-tvos was computed.  net9.0-windows was computed.  net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
1.0.0 112 8/31/2026