Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
bcquality/microsoft/knowledge/security/secretstrsubstno-for-composing-secrets.md
Jesper Schulz-Wedde aca3986fd0
Correct security and privacy knowledge guidance (#92) 
* Correct security and privacy guidance

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9c2eebc4-dcd5-4b85-8113-90772d818900

* Address security privacy review findings

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9c2eebc4-dcd5-4b85-8113-90772d818900

---------

Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com>
2026-07-14 11:25:03 +02:00

1.2 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
23..
security
secretstrsubstno
secrettext
strsubstno
format
compose
al
w1
all

Use SecretStrSubstNo to compose strings that contain secrets

Description

SecretStrSubstNo is the secret-preserving counterpart of StrSubstNo. It inserts SecretText arguments into %1, %2, and similar placeholders and returns SecretText without materializing the result as plain text. It is the right tool for values such as a Token %1 authorization header or a URI with an API key placeholder.

Best Practice

Compose every secret-bearing string through SecretStrSubstNo, ensure the format contains a placeholder for each secret, and keep the result as SecretText. Pass it to HttpRequestMessage.SetSecretRequestUri, HttpHeaders.Add, or HttpContent.WriteFrom. See sample: secretstrsubstno-for-composing-secrets.good.al.

Anti Pattern

Keeping a credential in Text and inserting it with StrSubstNo, or calling SecretStrSubstNo with a format that has no placeholder for the secret. The first exposes the value as plain text; the second silently omits it. See sample: secretstrsubstno-for-composing-secrets.bad.al.