Securing data in Polly cache

Summary: What are you wanting to achieve? When data is stored in a cache, you can retrieve it if you have access and an appropriate key, but depending on the nature of the data it might be important to encrypt it in some manner.

ASP.NET Core introduces interfaces to help with this IDataProtectionProvider/IDataProtector. This allows you to encrypt/decrypt the data stored in the cache in a secure manner for the app/purpose.

Here’s an example usage where access tokens are cached encrypted

What code or approach do you have so far?
Here’s a rough mock up of what I think it should be…

IDataProtectionProvider provider = services.GetRequiredService<IDataProtectionProvider>();
var dataProtector = provider.CreateProvider("Foo")
var cachePolicy = Policy.Cache<byte[]>(distributedCache.AsSyncCacheProvider<byte[]>(), dataProtector, TimeSpan.FromMinutes(5));

Alternatively we could inject the provider and purpose

IDataProtectionProvider provider = services.GetRequiredService<IDataProtectionProvider>();
var cachePolicy = Policy.Cache<byte[]>(distributedCache.AsSyncCacheProvider<byte[]>(), provider, "Foo", TimeSpan.FromMinutes(5));

Thoughts/comments?

[phatcher]

@reisenberger Yes, something like that, the encryption is just a decorator around the cache serialization. How you get to the correct IDataProtectionProvider is a setup issue anyway, so its fine.

I’m not sure how long an IDataProtector is supposed to live for, so I might change it to something like this…

DataProtectionSerializer : ICacheItemSerializer<TUnecnrypted, TEncrypted>
{
    private IDataProtectonProvicer _provider;
    private string _purpose;

    public DataProtectionSerializer(IDataProtectionProvider protector, string purpose)
    {
      _provider = provider; /* add null defence */
      _purpose = purpose; /* add null defence */
    }

    TEncrypted Serialize(TUnecnrypted objectToSerialize) => Protector.Protect(objectToSerialize);
    TUnecnrypted Deserialize(TEncrypted objectToDeserialize) => Protector.Unprotect(objectToDeserialize);

    private IDataProtector Prototector => _provider.CreateProtector(_purpose);
}

I’ll have a play and if it works nicely, I’ll update the documentation pages - might take me a few days

[reisenberger]

Np.