ASP.NET Core Configuration & Secrets Mastery: Complete Security Guide (Part- 17 of 40)

Real-Life Scenario : Multi-cloud deployment with AWS infrastructure

  
    // AWS Secrets Manager configuration provider
public class AwsSecretsManagerConfigurationProvider : ConfigurationProvider
{
    private readonly string _region;
    private readonly string _secretName;
    private readonly IAmazonSecretsManager _secretsClient;

    public AwsSecretsManagerConfigurationProvider(string region, string secretName)
    {
        _region = region;
        _secretName = secretName;
        _secretsClient = new AmazonSecretsManagerClient(RegionEndpoint.GetBySystemName(region));
    }

    public override void Load()
    {
        try
        {
            var secret = GetSecretValueAsync().GetAwaiter().GetResult();
            var data = ParseSecretString(secret);
            Data = data;
        }
        catch (Exception ex)
        {
            throw new InvalidOperationException($"Failed to load secrets from AWS Secrets Manager: {ex.Message}", ex);
        }
    }

    private async Task<string> GetSecretValueAsync()
    {
        var request = new GetSecretValueRequest
        {
            SecretId = _secretName
        };

        var response = await _secretsClient.GetSecretValueAsync(request);
        return response.SecretString;
    }

    private Dictionary<string, string> ParseSecretString(string secretString)
    {
        var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
        
        try
        {
            var json = JsonDocument.Parse(secretString);
            ParseJsonElement(json.RootElement, "", data);
        }
        catch (JsonException)
        {
            // If not JSON, treat as simple key-value pairs
            data[_secretName] = secretString;
        }
        
        return data;
    }

    private void ParseJsonElement(JsonElement element, string prefix, Dictionary<string, string> data)
    {
        switch (element.ValueKind)
        {
            case JsonValueKind.Object:
                foreach (var property in element.EnumerateObject())
                {
                    var currentKey = string.IsNullOrEmpty(prefix) 
                        ? property.Name 
                        : $"{prefix}:{property.Name}";
                    ParseJsonElement(property.Value, currentKey, data);
                }
                break;
                
            case JsonValueKind.Array:
                var index = 0;
                foreach (var item in element.EnumerateArray())
                {
                    var currentKey = $"{prefix}:{index}";
                    ParseJsonElement(item, currentKey, data);
                    index++;
                }
                break;
                
            default:
                data[prefix] = element.ToString();
                break;
        }
    }
}

public class AwsSecretsManagerConfigurationSource : IConfigurationSource
{
    public string Region { get; set; }
    public string SecretName { get; set; }

    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new AwsSecretsManagerConfigurationProvider(Region, SecretName);
    }
}

public static class AwsSecretsManagerConfigurationExtensions
{
    public static IConfigurationBuilder AddAwsSecretsManager(
        this IConfigurationBuilder builder,
        string region,
        string secretName)
    {
        return builder.Add(new AwsSecretsManagerConfigurationSource
        {
            Region = region,
            SecretName = secretName
        });
    }
}
  

Multi-Cloud Secret Management

  
    // Unified secret management service
public interface ISecretManager
{
    Task<string> GetSecretAsync(string secretName);
    Task SetSecretAsync(string secretName, string secretValue);
    Task<bool> SecretExistsAsync(string secretName);
}

public class MultiCloudSecretManager : ISecretManager
{
    private readonly KeyVaultSecretManager _azureSecretManager;
    private readonly AwsSecretManager _awsSecretManager;
    private readonly IConfiguration _configuration;
    private readonly ILogger<MultiCloudSecretManager> _logger;

    public MultiCloudSecretManager(
        KeyVaultSecretManager azureSecretManager,
        AwsSecretManager awsSecretManager,
        IConfiguration configuration,
        ILogger<MultiCloudSecretManager> logger)
    {
        _azureSecretManager = azureSecretManager;
        _awsSecretManager = awsSecretManager;
        _configuration = configuration;
        _logger = logger;
    }

    public async Task<string> GetSecretAsync(string secretName)
    {
        // Determine which cloud provider to use based on configuration
        var cloudProvider = _configuration["CloudProvider"] ?? "Azure";
        
        try
        {
            return cloudProvider switch
            {
                "Azure" => await _azureSecretManager.GetSecretAsync(secretName),
                "AWS" => await _awsSecretManager.GetSecretAsync(secretName),
                _ => throw new InvalidOperationException($"Unsupported cloud provider: {cloudProvider}")
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to retrieve secret '{SecretName}' from {CloudProvider}", 
                secretName, cloudProvider);
            throw;
        }
    }

    public async Task SetSecretAsync(string secretName, string secretValue)
    {
        var cloudProvider = _configuration["CloudProvider"] ?? "Azure";
        
        try
        {
            switch (cloudProvider)
            {
                case "Azure":
                    await _azureSecretManager.SetSecretAsync(secretName, secretValue);
                    break;
                case "AWS":
                    await _awsSecretManager.SetSecretAsync(secretName, secretValue);
                    break;
                default:
                    throw new InvalidOperationException($"Unsupported cloud provider: {cloudProvider}");
            }
            
            _logger.LogInformation("Secret '{SecretName}' updated in {CloudProvider}", 
                secretName, cloudProvider);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to set secret '{SecretName}' in {CloudProvider}", 
                secretName, cloudProvider);
            throw;
        }
    }

    public async Task<bool> SecretExistsAsync(string secretName)
    {
        var cloudProvider = _configuration["CloudProvider"] ?? "Azure";
        
        return cloudProvider switch
        {
            "Azure" => await _azureSecretManager.SecretExistsAsync(secretName),
            "AWS" => await _awsSecretManager.SecretExistsAsync(secretName),
            _ => throw new InvalidOperationException($"Unsupported cloud provider: {cloudProvider}")
        };
    }
}

// AWS Secret Manager implementation
public class AwsSecretManager
{
    private readonly IAmazonSecretsManager _secretsClient;
    private readonly ILogger<AwsSecretManager> _logger;

    public AwsSecretManager(string region, ILogger<AwsSecretManager> logger)
    {
        _secretsClient = new AmazonSecretsManagerClient(RegionEndpoint.GetBySystemName(region));
        _logger = logger;
    }

    public async Task<string> GetSecretAsync(string secretName)
    {
        try
        {
            var request = new GetSecretValueRequest { SecretId = secretName };
            var response = await _secretsClient.GetSecretValueAsync(request);
            return response.SecretString;
        }
        catch (ResourceNotFoundException)
        {
            _logger.LogWarning("Secret '{SecretName}' not found in AWS Secrets Manager", secretName);
            return null;
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to retrieve secret '{SecretName}' from AWS Secrets Manager", secretName);
            throw;
        }
    }

    public async Task SetSecretAsync(string secretName, string secretValue)
    {
        try
        {
            var request = new PutSecretValueRequest
            {
                SecretId = secretName,
                SecretString = secretValue
            };
            
            await _secretsClient.PutSecretValueAsync(request);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to set secret '{SecretName}' in AWS Secrets Manager", secretName);
            throw;
        }
    }

    public async Task<bool> SecretExistsAsync(string secretName)
    {
        try
        {
            await GetSecretAsync(secretName);
            return true;
        }
        catch (ResourceNotFoundException)
        {
            return false;
        }
    }
}
  

11. Database Configuration Provider

Dynamic Database Configuration

Real-Life Scenario : Application that needs runtime configuration changes without redeployment

  
    // Advanced database configuration provider
public class DynamicDatabaseConfigurationProvider : ConfigurationProvider, IDisposable
{
    private readonly DynamicDatabaseConfigurationSource _source;
    private readonly Timer _refreshTimer;
    private readonly ILogger<DynamicDatabaseConfigurationProvider> _logger;
    private bool _disposed = false;

    public DynamicDatabaseConfigurationProvider(DynamicDatabaseConfigurationSource source)
    {
        _source = source;
        _logger = source.LoggerFactory?.CreateLogger<DynamicDatabaseConfigurationProvider>();

        if (_source.ReloadOnChange)
        {
            _refreshTimer = new Timer(async _ => await RefreshConfigurationAsync(), 
                null, 
                TimeSpan.FromSeconds(_source.ReloadInterval), 
                TimeSpan.FromSeconds(_source.ReloadInterval));
        }
    }

    public override void Load()
    {
        LoadAsync().GetAwaiter().GetResult();
    }

    private async Task LoadAsync()
    {
        try
        {
            await RefreshConfigurationAsync();
        }
        catch (Exception ex)
        {
            _logger?.LogError(ex, "Failed to load configuration from database");
            throw;
        }
    }

    private async Task RefreshConfigurationAsync()
    {
        try
        {
            var newData = await LoadConfigurationFromDatabaseAsync();
            
            if (!Data.SequenceEqual(newData))
            {
                Data = newData;
                OnReload();
                _logger?.LogInformation("Configuration reloaded from database");
            }
        }
        catch (Exception ex)
        {
            _logger?.LogError(ex, "Failed to refresh configuration from database");
        }
    }

    private async Task<Dictionary<string, string>> LoadConfigurationFromDatabaseAsync()
    {
        var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
        
        await using var connection = new SqlConnection(_source.ConnectionString);
        await connection.OpenAsync();
        
        var command = new SqlCommand(_source.Query, connection);
        command.Parameters.AddWithValue("@Environment", _source.Environment);
        command.Parameters.AddWithValue("@Application", _source.ApplicationName);
        
        await using var reader = await command.ExecuteReaderAsync();
        while (await reader.ReadAsync())
        {
            var key = reader.GetString(0);
            var value = reader.IsDBNull(1) ? null : reader.GetString(1);
            data[key] = value;
        }
        
        return data;
    }

    public void Dispose()
    {
        if (!_disposed)
        {
            _refreshTimer?.Dispose();
            _disposed = true;
        }
    }
}

public class DynamicDatabaseConfigurationSource : IConfigurationSource
{
    public string ConnectionString { get; set; }
    public string Query { get; set; } = 
        "SELECT [Key], [Value] FROM Configuration WHERE ([Environment] = @Environment OR [Environment] IS NULL) AND ([Application] = @Application OR [Application] IS NULL)";
    public string Environment { get; set; }
    public string ApplicationName { get; set; }
    public bool ReloadOnChange { get; set; } = true;
    public int ReloadInterval { get; set; } = 30;
    public ILoggerFactory LoggerFactory { get; set; }

    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new DynamicDatabaseConfigurationProvider(this);
    }
}

public static class DynamicDatabaseConfigurationExtensions
{
    public static IConfigurationBuilder AddDynamicDatabaseConfiguration(
        this IConfigurationBuilder builder,
        string connectionString,
        string environment,
        string applicationName = null,
        bool reloadOnChange = true,
        int reloadInterval = 30,
        ILoggerFactory loggerFactory = null)
    {
        return builder.Add(new DynamicDatabaseConfigurationSource
        {
            ConnectionString = connectionString,
            Environment = environment,
            ApplicationName = applicationName,
            ReloadOnChange = reloadOnChange,
            ReloadInterval = reloadInterval,
            LoggerFactory = loggerFactory
        });
    }
}
  

Configuration Management API

  
    // API for managing configuration in database
[ApiController]
[Route("api/[controller]")]
public class ConfigurationController : ControllerBase
{
    private readonly ApplicationDbContext _context;
    private readonly IConfiguration _configuration;
    private readonly ILogger<ConfigurationController> _logger;

    public ConfigurationController(
        ApplicationDbContext context,
        IConfiguration configuration,
        ILogger<ConfigurationController> logger)
    {
        _context = context;
        _configuration = configuration;
        _logger = logger;
    }

    [HttpGet]
    public async Task<ActionResult<IEnumerable<ConfigurationItem>>> GetConfiguration(
        [FromQuery] string environment = null,
        [FromQuery] string application = null)
    {
        var query = _context.Configuration.AsQueryable();

        if (!string.IsNullOrEmpty(environment))
        {
            query = query.Where(c => c.Environment == environment || c.Environment == null);
        }

        if (!string.IsNullOrEmpty(application))
        {
            query = query.Where(c => c.Application == application || c.Application == null);
        }

        var items = await query.ToListAsync();
        return Ok(items);
    }

    [HttpPost]
    public async Task<ActionResult<ConfigurationItem>> CreateConfiguration(
        ConfigurationItem item)
    {
        // Validate the configuration key
        if (string.IsNullOrEmpty(item.Key))
        {
            return BadRequest("Key is required");
        }

        // Check if configuration already exists
        var existing = await _context.Configuration
            .Where(c => c.Key == item.Key && 
                       c.Environment == item.Environment && 
                       c.Application == item.Application)
            .FirstOrDefaultAsync();

        if (existing != null)
        {
            return Conflict($"Configuration with key '{item.Key}' already exists");
        }

        _context.Configuration.Add(item);
        await _context.SaveChangesAsync();

        _logger.LogInformation("Configuration created: {Key} for {Environment}/{Application}", 
            item.Key, item.Environment, item.Application);

        return CreatedAtAction(nameof(GetConfigurationItem), 
            new { id = item.Id }, item);
    }

    [HttpPut("{id}")]
    public async Task<IActionResult> UpdateConfiguration(int id, ConfigurationItem item)
    {
        if (id != item.Id)
        {
            return BadRequest();
        }

        var existing = await _context.Configuration.FindAsync(id);
        if (existing == null)
        {
            return NotFound();
        }

        existing.Value = item.Value;
        existing.UpdatedAt = DateTime.UtcNow;
        existing.UpdatedBy = User.Identity.Name;

        await _context.SaveChangesAsync();

        _logger.LogInformation("Configuration updated: {Key}", existing.Key);

        return NoContent();
    }

    [HttpDelete("{id}")]
    public async Task<IActionResult> DeleteConfiguration(int id)
    {
        var item = await _context.Configuration.FindAsync(id);
        if (item == null)
        {
            return NotFound();
        }

        _context.Configuration.Remove(item);
        await _context.SaveChangesAsync();

        _logger.LogInformation("Configuration deleted: {Key}", item.Key);

        return NoContent();
    }

    [HttpGet("{id}")]
    public async Task<ActionResult<ConfigurationItem>> GetConfigurationItem(int id)
    {
        var item = await _context.Configuration.FindAsync(id);
        if (item == null)
        {
            return NotFound();
        }
        return item;
    }
}

// Configuration entity model
public class ConfigurationItem
{
    public int Id { get; set; }
    
    [Required]
    [StringLength(200)]
    public string Key { get; set; }
    
    public string Value { get; set; }
    
    [StringLength(50)]
    public string Environment { get; set; }
    
    [StringLength(50)]
    public string Application { get; set; }
    
    public string Description { get; set; }
    
    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
    public string CreatedBy { get; set; }
    
    public DateTime? UpdatedAt { get; set; }
    public string UpdatedBy { get; set; }
    
    public bool IsSensitive { get; set; }
}
  

12. Configuration Best Practices

Security Best Practices

  
    // Security-focused configuration validation
public class SecurityConfigurationValidator
{
    private readonly IConfiguration _configuration;
    private readonly ILogger<SecurityConfigurationValidator> _logger;

    public SecurityConfigurationValidator(
        IConfiguration configuration,
        ILogger<SecurityConfigurationValidator> logger)
    {
        _configuration = configuration;
        _logger = logger;
    }

    public void ValidateSecuritySettings()
    {
        ValidateNoSecretsInAppSettings();
        ValidateConnectionStrings();
        ValidateApiKeys();
        ValidateJwtSettings();
    }

    private void ValidateNoSecretsInAppSettings()
    {
        var appSettingsPath = "appsettings.json";
        if (File.Exists(appSettingsPath))
        {
            var content = File.ReadAllText(appSettingsPath);
            
            var sensitivePatterns = new[]
            {
                @"(?i)password[=:""']([^""']+)",
                @"(?i)pwd[=:""']([^""']+)",
                @"(?i)secret[=:""']([^""']+)",
                @"(?i)key[=:""']([^""']+)",
                @"(?i)token[=:""']([^""']+)",
                @"sk_live_[a-zA-Z0-9]+",
                @"SG\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+"
            };

            foreach (var pattern in sensitivePatterns)
            {
                var matches = System.Text.RegularExpressions.Regex.Matches(content, pattern);
                if (matches.Count > 0)
                {
                    _logger.LogWarning(
                        "Potential secrets found in appsettings.json. Pattern: {Pattern}. " +
                        "Consider moving these to secure storage.", pattern);
                }
            }
        }
    }

    private void ValidateConnectionStrings()
    {
        var connectionStrings = _configuration.GetSection("ConnectionStrings").GetChildren();
        
        foreach (var connectionString in connectionStrings)
        {
            if (string.IsNullOrEmpty(connectionString.Value))
            {
                throw new InvalidOperationException(
                    $"Connection string '{connectionString.Key}' is empty");
            }

            // Check for weak passwords in connection strings
            if (ContainsWeakPassword(connectionString.Value))
            {
                _logger.LogWarning(
                    "Connection string '{Key}' may contain weak password", 
                    connectionString.Key);
            }
        }
    }

    private void ValidateApiKeys()
    {
        var apiKeysSection = _configuration.GetSection("ApiKeys");
        if (apiKeysSection.Exists())
        {
            foreach (var apiKey in apiKeysSection.GetChildren())
            {
                if (string.IsNullOrEmpty(apiKey.Value))
                {
                    throw new InvalidOperationException($"API key '{apiKey.Key}' is empty");
                }

                if (apiKey.Value.Length < 16)
                {
                    _logger.LogWarning("API key '{Key}' may be too short", apiKey.Key);
                }
            }
        }
    }

    private void ValidateJwtSettings()
    {
        var jwtSection = _configuration.GetSection("Security:Jwt");
        if (jwtSection.Exists())
        {
            var secretKey = jwtSection["SecretKey"];
            if (string.IsNullOrEmpty(secretKey))
            {
                throw new InvalidOperationException("JWT secret key is required");
            }

            if (secretKey.Length < 32)
            {
                throw new InvalidOperationException(
                    "JWT secret key must be at least 32 characters long");
            }

            if (secretKey.Equals("your-super-secret-key-here", StringComparison.OrdinalIgnoreCase))
            {
                throw new InvalidOperationException(
                    "JWT secret key must be changed from the default value");
            }
        }
    }

    private bool ContainsWeakPassword(string connectionString)
    {
        var weakPasswords = new[] { "password", "123456", "admin", "sa", "test" };
        return weakPasswords.Any(weak => 
            connectionString.Contains($"Password={weak}") || 
            connectionString.Contains($"Pwd={weak}"));
    }
}
  

Performance Optimization

  
    // Configuration performance optimization
public class OptimizedConfigurationService
{
    private readonly IConfiguration _configuration;
    private readonly ConcurrentDictionary<string, object> _cache;
    private readonly TimeSpan _cacheDuration;

    public OptimizedConfigurationService(IConfiguration configuration)
    {
        _configuration = configuration;
        _cache = new ConcurrentDictionary<string, object>();
        _cacheDuration = TimeSpan.FromMinutes(5);
    }

    public T GetValue<T>(string key, T defaultValue = default)
    {
        var cacheKey = $"{typeof(T).Name}:{key}";
        
        if (_cache.TryGetValue(cacheKey, out var cachedValue) && 
            cachedValue is CacheItem<T> cacheItem && 
            cacheItem.Expiry > DateTime.UtcNow)
        {
            return cacheItem.Value;
        }

        var value = _configuration.GetValue(key, defaultValue);
        _cache[cacheKey] = new CacheItem<T>(value, DateTime.UtcNow.Add(_cacheDuration));
        
        return value;
    }

    public T GetSection<T>(string sectionKey) where T : class, new()
    {
        var cacheKey = $"{typeof(T).Name}:{sectionKey}";
        
        if (_cache.TryGetValue(cacheKey, out var cachedValue) && 
            cachedValue is CacheItem<T> cacheItem && 
            cacheItem.Expiry > DateTime.UtcNow)
        {
            return cacheItem.Value;
        }

        var section = _configuration.GetSection(sectionKey);
        var value = new T();
        section.Bind(value);
        
        _cache[cacheKey] = new CacheItem<T>(value, DateTime.UtcNow.Add(_cacheDuration));
        
        return value;
    }

    public void ClearCache()
    {
        _cache.Clear();
    }

    public void RemoveFromCache(string key)
    {
        _cache.TryRemove(key, out _);
    }

    private class CacheItem<T>
    {
        public T Value { get; }
        public DateTime Expiry { get; }

        public CacheItem(T value, DateTime expiry)
        {
            Value = value;
            Expiry = expiry;
        }
    }
}

// Configuration change detection and cache invalidation
public class ConfigurationChangeNotifier : IDisposable
{
    private readonly IConfiguration _configuration;
    private readonly OptimizedConfigurationService _configService;
    private readonly ILogger<ConfigurationChangeNotifier> _logger;
    private readonly List<IDisposable> _changeCallbacks;

    public ConfigurationChangeNotifier(
        IConfiguration configuration,
        OptimizedConfigurationService configService,
        ILogger<ConfigurationChangeNotifier> logger)
    {
        _configuration = configuration;
        _configService = configService;
        _logger = logger;
        _changeCallbacks = new List<IDisposable>();

        SetupChangeDetection();
    }

    private void SetupChangeDetection()
    {
        // Monitor specific sections for changes
        var sectionsToMonitor = new[] { "Database", "Features", "CacheSettings" };
        
        foreach (var section in sectionsToMonitor)
        {
            var changeToken = _configuration.GetReloadToken();
            var callback = changeToken.RegisterChangeCallback(_ => OnConfigurationChanged(section), section);
            _changeCallbacks.Add(callback);
        }
    }

    private void OnConfigurationChanged(string section)
    {
        _logger.LogInformation("Configuration section '{Section}' changed, clearing cache", section);
        _configService.ClearCache();
        
        // Re-register for changes
        SetupChangeDetection();
    }

    public void Dispose()
    {
        foreach (var callback in _changeCallbacks)
        {
            callback?.Dispose();
        }
        _changeCallbacks.Clear();
    }
}
  

13. Security Considerations

Comprehensive Security Validation

  
    // Advanced security configuration analyzer
public class SecurityConfigurationAnalyzer
{
    private readonly IConfiguration _configuration;
    private readonly IWebHostEnvironment _environment;
    private readonly ILogger<SecurityConfigurationAnalyzer> _logger;

    public SecurityConfigurationAnalyzer(
        IConfiguration configuration,
        IWebHostEnvironment environment,
        ILogger<SecurityConfigurationAnalyzer> logger)
    {
        _configuration = configuration;
        _environment = environment;
        _logger = logger;
    }

    public SecurityAnalysisResult Analyze()
    {
        var result = new SecurityAnalysisResult();
        
        result.Issues.AddRange(CheckForHardcodedSecrets());
        result.Issues.AddRange(CheckWeakEncryption());
        result.Issues.AddRange(CheckInsecureProtocols());
        result.Issues.AddRange(CheckExposedEndpoints());
        result.Issues.AddRange(CheckCorsSettings());
        result.Issues.AddRange(CheckJwtSecurity());
        
        result.Score = CalculateSecurityScore(result.Issues);
        
        return result;
    }

    private IEnumerable<SecurityIssue> CheckForHardcodedSecrets()
    {
        var issues = new List<SecurityIssue>();
        
        // Check appsettings for common secret patterns
        var appSettingsPath = Path.Combine(_environment.ContentRootPath, "appsettings.json");
        if (File.Exists(appSettingsPath))
        {
            var content = File.ReadAllText(appSettingsPath);
            
            var secretPatterns = new[]
            {
                new { Pattern = @"(?i)[""']?password[""']?\s*[:=]\s*[""']([^""']+)[""']", Type = "Hardcoded Password" },
                new { Pattern = @"(?i)[""']?apikey[""']?\s*[:=]\s*[""']([^""']+)[""']", Type = "Hardcoded API Key" },
                new { Pattern = @"(?i)[""']?secret[""']?\s*[:=]\s*[""']([^""']+)[""']", Type = "Hardcoded Secret" },
                new { Pattern = @"sk_live_[a-zA-Z0-9]{24}", Type = "Stripe Secret Key" },
                new { Pattern = @"SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}", Type = "SendGrid API Key" }
            };

            foreach (var pattern in secretPatterns)
            {
                var matches = System.Text.RegularExpressions.Regex.Matches(content, pattern.Pattern);
                foreach (Match match in matches)
                {
                    issues.Add(new SecurityIssue
                    {
                        Type = pattern.Type,
                        Severity = SecuritySeverity.High,
                        Message = $"{pattern.Type} found in appsettings.json",
                        Recommendation = "Move to secure storage like Azure Key Vault or AWS Secrets Manager"
                    });
                }
            }
        }
        
        return issues;
    }

    private IEnumerable<SecurityIssue> CheckWeakEncryption()
    {
        var issues = new List<SecurityIssue>();
        
        var jwtSecret = _configuration["Security:Jwt:SecretKey"];
        if (!string.IsNullOrEmpty(jwtSecret) && jwtSecret.Length < 32)
        {
            issues.Add(new SecurityIssue
            {
                Type = "Weak JWT Secret",
                Severity = SecuritySeverity.High,
                Message = "JWT secret key is too short (minimum 32 characters recommended)",
                Recommendation = "Generate a strong random secret key with at least 32 characters"
            });
        }
        
        return issues;
    }

    private IEnumerable<SecurityIssue> CheckInsecureProtocols()
    {
        var issues = new List<SecurityIssue>();
        
        var paymentUrl = _configuration["PaymentGateway:BaseUrl"];
        if (!string.IsNullOrEmpty(paymentUrl) && paymentUrl.StartsWith("http://"))
        {
            issues.Add(new SecurityIssue
            {
                Type = "Insecure Protocol",
                Severity = SecuritySeverity.Medium,
                Message = "Payment gateway URL uses HTTP instead of HTTPS",
                Recommendation = "Use HTTPS for all external service communications"
            });
        }
        
        return issues;
    }

    private IEnumerable<SecurityIssue> CheckExposedEndpoints()
    {
        var issues = new List<SecurityIssue>();
        
        if (_environment.IsProduction())
        {
            var enableSwagger = _configuration.GetValue<bool>("Features:EnableSwagger");
            if (enableSwagger)
            {
                issues.Add(new SecurityIssue
                {
                    Type = "Exposed Development Tool",
                    Severity = SecuritySeverity.Medium,
                    Message = "Swagger is enabled in production environment",
                    Recommendation = "Disable Swagger in production for security"
                });
            }
        }
        
        return issues;
    }

    private IEnumerable<SecurityIssue> CheckCorsSettings()
    {
        var issues = new List<SecurityIssue>();
        
        var corsOrigins = _configuration.GetSection("Security:Cors:AllowedOrigins").Get<string[]>();
        if (corsOrigins != null && corsOrigins.Contains("*"))
        {
            issues.Add(new SecurityIssue
            {
                Type = "Overly Permissive CORS",
                Severity = SecuritySeverity.High,
                Message = "CORS policy allows all origins (*)",
                Recommendation = "Restrict CORS to specific trusted domains"
            });
        }
        
        return issues;
    }

    private IEnumerable<SecurityIssue> CheckJwtSecurity()
    {
        var issues = new List<SecurityIssue>();
        
        var expiration = _configuration.GetValue<int>("Security:Jwt:ExpirationMinutes");
        if (expiration > 1440) // 24 hours
        {
            issues.Add(new SecurityIssue
            {
                Type = "Long JWT Expiration",
                Severity = SecuritySeverity.Medium,
                Message = $"JWT token expiration ({expiration} minutes) is too long",
                Recommendation = "Set JWT expiration to 15-60 minutes for better security"
            });
        }
        
        return issues;
    }

    private int CalculateSecurityScore(List<SecurityIssue> issues)
    {
        var baseScore = 100;
        
        foreach (var issue in issues)
        {
            baseScore -= issue.Severity switch
            {
                SecuritySeverity.High => 20,
                SecuritySeverity.Medium => 10,
                SecuritySeverity.Low => 5,
                _ => 0
            };
        }
        
        return Math.Max(0, baseScore);
    }
}

public class SecurityAnalysisResult
{
    public List<SecurityIssue> Issues { get; set; } = new List<SecurityIssue>();
    public int Score { get; set; }
    public DateTime AnalyzedAt { get; set; } = DateTime.UtcNow;
}

public class SecurityIssue
{
    public string Type { get; set; }
    public SecuritySeverity Severity { get; set; }
    public string Message { get; set; }
    public string Recommendation { get; set; }
}

public enum SecuritySeverity
{
    Low,
    Medium,
    High
}
  

14. Troubleshooting Common Issues

Configuration Troubleshooting Tools

  
    // Comprehensive configuration diagnostics
public class ConfigurationDiagnostics
{
    private readonly IConfiguration _configuration;
    private readonly ILogger<ConfigurationDiagnostics> _logger;

    public ConfigurationDiagnostics(IConfiguration configuration, ILogger<ConfigurationDiagnostics> logger)
    {
        _configuration = configuration;
        _logger = logger;
    }

    public async Task<ConfigurationDiagnosticResult> RunDiagnosticsAsync()
    {
        var result = new ConfigurationDiagnosticResult();
        
        result.Issues.AddRange(await CheckConfigurationSourcesAsync());
        result.Issues.AddRange(CheckRequiredSettings());
        result.Issues.AddRange(CheckConfigurationValues());
        result.Issues.AddRange(CheckExternalDependenciesAsync().GetAwaiter().GetResult());
        
        return result;
    }

    private async Task<List<DiagnosticIssue>> CheckConfigurationSourcesAsync()
    {
        var issues = new List<DiagnosticIssue>();
        
        // Check if appsettings files exist
        var expectedFiles = new[] { "appsettings.json", $"appsettings.{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")}.json" };
        
        foreach (var file in expectedFiles)
        {
            if (!File.Exists(file))
            {
                issues.Add(new DiagnosticIssue
                {
                    Level = DiagnosticLevel.Warning,
                    Category = "Configuration Files",
                    Message = $"Configuration file '{file}' not found",
                    Details = "This file is optional but recommended for environment-specific settings"
                });
            }
        }
        
        // Check environment variables
        var requiredEnvVars = new[] { "ASPNETCORE_ENVIRONMENT" };
        foreach (var envVar in requiredEnvVars)
        {
            if (string.IsNullOrEmpty(Environment.GetEnvironmentVariable(envVar)))
            {
                issues.Add(new DiagnosticIssue
                {
                    Level = DiagnosticLevel.Warning,
                    Category = "Environment Variables",
                    Message = $"Environment variable '{envVar}' is not set",
                    Details = "Defaulting to 'Production' environment"
                });
            }
        }
        
        return issues;
    }

    private List<DiagnosticIssue> CheckRequiredSettings()
    {
        var issues = new List<DiagnosticIssue>();
        
        var requiredSettings = new[]
        {
            "ConnectionStrings:DefaultConnection",
            "Security:Jwt:SecretKey",
            "Security:Jwt:Issuer",
            "Security:Jwt:Audience"
        };
        
        foreach (var setting in requiredSettings)
        {
            var value = _configuration[setting];
            if (string.IsNullOrEmpty(value))
            {
                issues.Add(new DiagnosticIssue
                {
                    Level = DiagnosticLevel.Error,
                    Category = "Required Settings",
                    Message = $"Required configuration setting '{setting}' is missing or empty",
                    Details = "This will cause application startup to fail"
                });
            }
        }
        
        return issues;
    }

    private List<DiagnosticIssue> CheckConfigurationValues()
    {
        var issues = new List<DiagnosticIssue>();
        
        // Check numeric values
        var dbTimeout = _configuration.GetValue<int>("Database:Timeout", 0);
        if (dbTimeout <= 0)
        {
            issues.Add(new DiagnosticIssue
            {
                Level = DiagnosticLevel.Warning,
                Category = "Configuration Values",
                Message = "Database timeout is not set or invalid",
                Details = "Using default timeout of 30 seconds"
            });
        }
        
        // Check URL formats
        var paymentUrl = _configuration["PaymentGateway:BaseUrl"];
        if (!string.IsNullOrEmpty(paymentUrl) && !Uri.IsWellFormedUriString(paymentUrl, UriKind.Absolute))
        {
            issues.Add(new DiagnosticIssue
            {
                Level = DiagnosticLevel.Error,
                Category = "Configuration Values",
                Message = "Payment gateway URL is not a valid URI",
                Details = "This will cause payment operations to fail"
            });
        }
        
        return issues;
    }

    private async Task<List<DiagnosticIssue>> CheckExternalDependenciesAsync()
    {
        var issues = new List<DiagnosticIssue>();
        
        // Check database connectivity
        var connectionString = _configuration.GetConnectionString("DefaultConnection");
        if (!string.IsNullOrEmpty(connectionString))
        {
            try
            {
                await using var connection = new SqlConnection(connectionString);
                await connection.OpenAsync();
                await connection.CloseAsync();
            }
            catch (Exception ex)
            {
                issues.Add(new DiagnosticIssue
                {
                    Level = DiagnosticLevel.Error,
                    Category = "External Dependencies",
                    Message = "Cannot connect to database",
                    Details = $"Database connection failed: {ex.Message}"
                });
            }
        }
        
        return issues;
    }
}

public class ConfigurationDiagnosticResult
{
    public List<DiagnosticIssue> Issues { get; set; } = new List<DiagnosticIssue>();
    public DateTime DiagnosedAt { get; set; } = DateTime.UtcNow;
    public bool HasErrors => Issues.Any(i => i.Level == DiagnosticLevel.Error);
}

public class DiagnosticIssue
{
    public DiagnosticLevel Level { get; set; }
    public string Category { get; set; }
    public string Message { get; set; }
    public string Details { get; set; }
}

public enum DiagnosticLevel
{
    Information,
    Warning,
    Error
}

// Configuration debugging middleware
public class ConfigurationDebugMiddleware
{
    private readonly RequestDelegate _next;
    private readonly IConfiguration _configuration;
    private readonly ILogger<ConfigurationDebugMiddleware> _logger;

    public ConfigurationDebugMiddleware(
        RequestDelegate next,
        IConfiguration configuration,
        ILogger<ConfigurationDebugMiddleware> logger)
    {
        _next = next;
        _configuration = configuration;
        _logger = logger;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Only enable in development
        if (context.Request.Query.ContainsKey("debug-config"))
        {
            await WriteConfigurationDebugInfo(context);
            return;
        }

        await _next(context);
    }

    private async Task WriteConfigurationDebugInfo(HttpContext context)
    {
        context.Response.ContentType = "application/json";
        
        var debugInfo = new
        {
            Environment = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT"),
            ConfigurationSources = GetConfigurationSources(),
            AllSettings = GetAllConfigurationValues(),
            EnvironmentVariables = GetRelevantEnvironmentVariables()
        };
        
        var json = System.Text.Json.JsonSerializer.Serialize(debugInfo, new System.Text.Json.JsonSerializerOptions
        {
            WriteIndented = true
        });
        
        await context.Response.WriteAsync(json);
    }

    private List<string> GetConfigurationSources()
    {
        // This would need reflection to access internal configuration providers
        return new List<string>
        {
            "appsettings.json",
            $"appsettings.{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")}.json",
            "Environment Variables",
            "Command Line Arguments",
            "User Secrets (Development only)"
        };
    }

    private Dictionary<string, string> GetAllConfigurationValues()
    {
        var values = new Dictionary<string, string>();
        
        // Get all configuration values (be careful with secrets!)
        foreach (var (key, value) in _configuration.AsEnumerable())
        {
            if (!string.IsNullOrEmpty(key) && !IsSensitiveKey(key))
            {
                values[key] = value;
            }
        }
        
        return values;
    }

    private Dictionary<string, string> GetRelevantEnvironmentVariables()
    {
        var envVars = new Dictionary<string, string>();
        
        var relevantVars = Environment.GetEnvironmentVariables()
            .Cast<System.Collections.DictionaryEntry>()
            .Where(e => e.Key.ToString().StartsWith("ASPNETCORE_") || 
                       e.Key.ToString().StartsWith("TECHMART_"))
            .ToDictionary(e => e.Key.ToString(), e => e.Value.ToString());
        
        return relevantVars;
    }

    private bool IsSensitiveKey(string key)
    {
        var sensitiveKeywords = new[] { "password", "pwd", "secret", "key", "token", "connectionstring" };
        return sensitiveKeywords.Any(keyword => 
            key.Contains(keyword, StringComparison.OrdinalIgnoreCase));
    }
}
  

15. Real-World Implementation Examples

Enterprise-Grade Configuration Setup

  
    // Complete enterprise configuration setup
public class EnterpriseConfigurationBuilder
{
    public IHostBuilder CreateEnterpriseHostBuilder(string[] args, string applicationName)
    {
        return Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {
                var env = context.HostingEnvironment;
                
                ConfigureEnterpriseAppSettings(config, env);
                ConfigureEnterpriseSecrets(config, env, applicationName);
                ConfigureEnterpriseExternalSources(config, env, applicationName);
                ConfigureEnterpriseMonitoring(config);
            })
            .ConfigureLogging((context, logging) =>
            {
                logging.AddConfiguration(context.Configuration.GetSection("Logging"));
                logging.AddConsole();
                logging.AddDebug();
                logging.AddApplicationInsights();
            })
            .UseDefaultServiceProvider((context, options) =>
            {
                options.ValidateScopes = context.HostingEnvironment.IsDevelopment();
                options.ValidateOnBuild = true;
            });
    }

    private void ConfigureEnterpriseAppSettings(IConfigurationBuilder config, IHostEnvironment env)
    {
        // Base configuration
        config.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true);
        
        // Environment-specific configuration
        config.AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true, reloadOnChange: true);
        
        // Environment-specific machine configuration (for overrides)
        config.AddJsonFile($"appsettings.{env.EnvironmentName}.{Environment.MachineName}.json", 
            optional: true, reloadOnChange: true);
    }

    private void ConfigureEnterpriseSecrets(IConfigurationBuilder config, IHostEnvironment env, string applicationName)
    {
        if (env.IsDevelopment())
        {
            // User secrets for development
            config.AddUserSecrets<Program>();
        }
        else
        {
            // Cloud secrets for non-development environments
            var builtConfig = config.Build();
            
            // Azure Key Vault
            var azureKeyVaultEndpoint = builtConfig["AzureKeyVault:Endpoint"];
            if (!string.IsNullOrEmpty(azureKeyVaultEndpoint))
            {
                config.AddAzureKeyVault(
                    new Uri(azureKeyVaultEndpoint),
                    new DefaultAzureCredential());
            }
            
            // AWS Secrets Manager
            var awsRegion = builtConfig["AWS:Region"];
            var awsSecretName = builtConfig["AWS:Secrets:ApplicationSecretName"];
            if (!string.IsNullOrEmpty(awsRegion) && !string.IsNullOrEmpty(awsSecretName))
            {
                config.AddAwsSecretsManager(awsRegion, awsSecretName);
            }
        }
    }

    private void ConfigureEnterpriseExternalSources(IConfigurationBuilder config, IHostEnvironment env, string applicationName)
    {
        var builtConfig = config.Build();
        
        // Database configuration
        var dbConnectionString = builtConfig.GetConnectionString("ConfigurationDb");
        if (!string.IsNullOrEmpty(dbConnectionString))
        {
            config.AddDynamicDatabaseConfiguration(
                dbConnectionString,
                env.EnvironmentName,
                applicationName,
                reloadOnChange: true,
                reloadInterval: 60);
        }
        
        // Consul configuration for microservices
        var consulAddress = builtConfig["Consul:Address"];
        if (!string.IsNullOrEmpty(consulAddress))
        {
            config.AddConsulKeyValue(consulAddress, $"{applicationName}/{env.EnvironmentName}");
        }
    }

    private void ConfigureEnterpriseMonitoring(IConfigurationBuilder config)
    {
        // Application Insights
        config.AddApplicationInsightsSettings();
        
        // Health check configuration
        config.AddJsonFile("healthchecks.json", optional: true);
    }
}

// Real-world startup configuration
public class EnterpriseStartup
{
    public EnterpriseStartup(IConfiguration configuration, IWebHostEnvironment env)
    {
        Configuration = configuration;
        Environment = env;
        
        // Validate configuration on startup
        ValidateConfiguration();
    }

    public IConfiguration Configuration { get; }
    public IWebHostEnvironment Environment { get; }

    private void ValidateConfiguration()
    {
        var validator = new EnterpriseConfigurationValidator(Configuration, Environment);
        var result = validator.Validate();
        
        if (!result.IsValid)
        {
            throw new InvalidOperationException(
                $"Configuration validation failed: {string.Join(", ", result.Errors)}");
        }
    }

    public void ConfigureServices(IServiceCollection services)
    {
        // Configuration validation
        services.AddSingleton(new EnterpriseConfigurationValidator(Configuration, Environment));
        
        // Strongly-typed configuration
        services.Configure<EnterpriseAppSettings>(Configuration);
        services.Configure<DatabaseSettings>(Configuration.GetSection("Database"));
        services.Configure<SecuritySettings>(Configuration.GetSection("Security"));
        services.Configure<ExternalServicesSettings>(Configuration.GetSection("ExternalServices"));
        
        // Configuration-based service registration
        ConfigureDatabaseServices(services);
        ConfigureSecurityServices(services);
        ConfigureExternalServices(services);
        ConfigureApplicationServices(services);
        
        // Health checks
        services.AddHealthChecks()
            .AddSqlServer(Configuration.GetConnectionString("DefaultConnection"))
            .AddUrlGroup(new Uri(Configuration["ExternalServices:PaymentGateway:HealthCheck"]))
            .AddApplicationInsightsPublisher();
        
        // Caching
        ConfigureCaching(services);
    }

    private void ConfigureDatabaseServices(IServiceCollection services)
    {
        var databaseSettings = Configuration.GetSection("Database").Get<DatabaseSettings>();
        
        services.AddDbContext<ApplicationDbContext>(options =>
        {
            options.UseSqlServer(databaseSettings.ConnectionString, sqlOptions =>
            {
                sqlOptions.EnableRetryOnFailure(
                    maxRetryCount: databaseSettings.RetryCount,
                    maxRetryDelay: TimeSpan.FromSeconds(30),
                    errorNumbersToAdd: null);
            });
            
            if (Environment.IsDevelopment())
            {
                options.EnableSensitiveDataLogging();
                options.EnableDetailedErrors();
            }
        });
    }

    private void ConfigureSecurityServices(IServiceCollection services)
    {
        var securitySettings = Configuration.GetSection("Security").Get<SecuritySettings>();
        
        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidIssuer = securitySettings.Jwt.Issuer,
                    ValidAudience = securitySettings.Jwt.Audience,
                    IssuerSigningKey = new SymmetricSecurityKey(
                        Encoding.UTF8.GetBytes(securitySettings.Jwt.SecretKey))
                };
            });
        
        services.AddAuthorization(options =>
        {
            options.AddPolicy("AdminOnly", policy => 
                policy.RequireRole("Administrator"));
        });
    }

    private void ConfigureExternalServices(IServiceCollection services)
    {
        var externalServices = Configuration.GetSection("ExternalServices").Get<ExternalServicesSettings>();
        
        // Configure HTTP clients with retry policies
        services.AddHttpClient<IPaymentService, PaymentService>(client =>
        {
            client.BaseAddress = new Uri(externalServices.PaymentGateway.BaseUrl);
            client.DefaultRequestHeaders.Add("X-API-Key", externalServices.PaymentGateway.ApiKey);
        })
        .AddPolicyHandler(GetRetryPolicy())
        .AddPolicyHandler(GetCircuitBreakerPolicy());
        
        services.AddHttpClient<IEmailService, EmailService>(client =>
        {
            client.BaseAddress = new Uri(externalServices.EmailService.BaseUrl);
        })
        .AddPolicyHandler(GetRetryPolicy());
    }

    private void ConfigureApplicationServices(IServiceCollection services)
    {
        services.AddControllers();
        services.AddSwaggerGen(c =>
        {
            c.SwaggerDoc("v1", new OpenApiInfo { Title = "Enterprise API", Version = "v1" });
        });
        
        // Feature flags
        var featureSettings = Configuration.GetSection("Features").Get<FeatureSettings>();
        if (featureSettings.EnableCaching)
        {
            services.AddMemoryCache();
        }
        
        if (featureSettings.EnableBackgroundServices)
        {
            services.AddHostedService<DataSyncService>();
            services.AddHostedService<CleanupService>();
        }
    }

    private void ConfigureCaching(IServiceCollection services)
    {
        var cacheSettings = Configuration.GetSection("Cache").Get<CacheSettings>();
        
        if (cacheSettings.Type == "Redis")
        {
            services.AddStackExchangeRedisCache(options =>
            {
                options.Configuration = cacheSettings.RedisConnection;
                options.InstanceName = cacheSettings.InstanceName;
            });
        }
        else
        {
            services.AddDistributedMemoryCache();
        }
    }

    private static IAsyncPolicy<HttpResponseMessage> GetRetryPolicy()
    {
        return HttpPolicyExtensions
            .HandleTransientHttpError()
            .OrResult(msg => msg.StatusCode == System.Net.HttpStatusCode.TooManyRequests)
            .WaitAndRetryAsync(
                retryCount: 3,
                sleepDurationProvider: retryAttempt => TimeSpan.FromSeconds(Math.Pow(2, retryAttempt)),
                onRetry: (outcome, timespan, retryCount, context) =>
                {
                    // Log retry attempts
                });
    }

    private static IAsyncPolicy<HttpResponseMessage> GetCircuitBreakerPolicy()
    {
        return HttpPolicyExtensions
            .HandleTransientHttpError()
            .CircuitBreakerAsync(
                handledEventsAllowedBeforeBreaking: 3,
                durationOfBreak: TimeSpan.FromSeconds(30));
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseSwagger();
            app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "Enterprise API v1"));
        }
        else
        {
            app.UseExceptionHandler("/Error");
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseRouting();
        
        app.UseAuthentication();
        app.UseAuthorization();
        
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
            endpoints.MapHealthChecks("/health");
        });
        
        // Configuration diagnostics endpoint (development only)
        if (env.IsDevelopment())
        {
            app.UseMiddleware<ConfigurationDebugMiddleware>();
        }
    }
}

// Enterprise configuration classes
public class EnterpriseAppSettings
{
    public string ApplicationName { get; set; }
    public string Version { get; set; }
    public string Environment { get; set; }
    public FeatureSettings Features { get; set; }
    public CacheSettings Cache { get; set; }
}

public class FeatureSettings
{
    public bool EnableCaching { get; set; }
    public bool EnableBackgroundServices { get; set; }
    public bool EnableApiVersioning { get; set; }
    public bool EnableResponseCompression { get; set; }
}

public class CacheSettings
{
    public string Type { get; set; }
    public string RedisConnection { get; set; }
    public string InstanceName { get; set; }
    public int DefaultExpiration { get; set; } = 3600;
}

public class ExternalServicesSettings
{
    public PaymentGatewaySettings PaymentGateway { get; set; }
    public EmailServiceSettings EmailService { get; set; }
    public AnalyticsServiceSettings AnalyticsService { get; set; }
}

public class PaymentGatewaySettings
{
    public string BaseUrl { get; set; }
    public string ApiKey { get; set; }
    public string WebhookSecret { get; set; }
    public string HealthCheck { get; set; }
}

public class EnterpriseConfigurationValidator
{
    private readonly IConfiguration _configuration;
    private readonly IWebHostEnvironment _environment;

    public EnterpriseConfigurationValidator(IConfiguration configuration, IWebHostEnvironment environment)
    {
        _configuration = configuration;
        _environment = environment;
    }

    public ValidationResult Validate()
    {
        var errors = new List<string>();
        
        // Validate required settings
        if (string.IsNullOrEmpty(_configuration.GetConnectionString("DefaultConnection")))
        {
            errors.Add("Default database connection string is required");
        }
        
        // Validate security settings
        var jwtSecret = _configuration["Security:Jwt:SecretKey"];
        if (string.IsNullOrEmpty(jwtSecret) || jwtSecret.Length < 32)
        {
            errors.Add("JWT secret key must be at least 32 characters long");
        }
        
        // Validate external services
        var paymentUrl = _configuration["ExternalServices:PaymentGateway:BaseUrl"];
        if (string.IsNullOrEmpty(paymentUrl))
        {
            errors.Add("Payment gateway base URL is required");
        }
        
        return new ValidationResult
        {
            IsValid = !errors.Any(),
            Errors = errors
        };
    }
}

public class ValidationResult
{
    public bool IsValid { get; set; }
    public List<string> Errors { get; set; } = new List<string>();
}
  

This comprehensive guide covers ASP.NET Core configuration and secrets management from basic to advanced enterprise-level scenarios. The examples provided demonstrate real-world patterns and best practices that you can adapt for your specific application needs.

Remember to always prioritize security when handling configuration, especially when dealing with secrets and sensitive information. Use secure storage solutions like Azure Key Vault or AWS Secrets Manager in production environments, and never commit secrets to source control.