Data Protection API

ASP.NET Core uses Microsoft.AspNetCore.DataProtection to handle the encryption keys used to protect state values that get posted between the app and the client.

The Machine.config keys are no longer used for data protection in ASP.NET Core. Data Protection is quite an extensive topic; you can refer to the Microsoft documentation (https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/) to know more about this.

Note

The Cookie generation takes places using Data Protection APIs.

We will take a simple example of encrypting the ID values for a given entity.

Consider the BudgetCategory class having various properties that are uniquely identified by the ID. When we retrieve a list of budget categories or single objects, the ID passed should also be included. As this ID will be sensitive information to the business, we don't have to pass the real ID that is saved in the database.

For these kinds of requirement, we can encrypt while responding, and decrypt while receiving...