What is the .NET Data Protection API, and where should its keys be stored for production servers running across multiple instances?

Short answer

It is a built-in system for protecting cookies and password reset tokens; distributed servers should store keys centrally (such as in Redis or Azure Blob) and encrypt them with Key Vault.

Explanation

The Data Protection API encrypts temporary, sensitive application data. By default, keys are stored locally on disk. With several application servers behind a Load Balancer, one server cannot decrypt cookies issued by another. Configure PersistKeysToStackExchangeRedis or a shared database, and encrypt the key ring with ProtectKeysWithCertificate or Azure Key Vault.

Code example

builder.Services.AddDataProtection()
    .PersistKeysToStackExchangeRedis(redisConnection, "DataProtection-Keys")
    .SetApplicationName("SharedApp");

Common mistakes

• Keeping keys in the default local folder in cloud container environments, causing users to be logged out whenever a container restarts.

Follow-up questions

• How do you manage secrets and connection strings securely with Secret Manager in development and Azure Key Vault in production?

Sources

• Microsoft Learn — ASP.NET Core Data Protection overview