Azure KeyVault GetSecretAsync.Result.Value error handling

Question

I have the following line of code to return a secret from a KeyVault

string kvSecret = kVClient.GetSecretAsync(azureKeyVaultUrl, secret).Result.Value;

While this works as expected, I don't really know well how the Result.Value synchronous execution handles runtime errors, exceptions, etc.

I am trying to understand if there is any possibility when I call Result.Value where there is an error and the value returned is not actually the secret but some random error therefore my variable kvSecret doesn't contain the right value but something else.

Reason I am asking that is that I want to make sure that if the variable is not null or empty, it will always contain the secret and not other random string.

If there's an error, you'll get an exception, not a random value. You should never block an asynchronous operation though — Camilo Terevinto
– Camilo Terevinto, Commented Oct 19, 2018 at 22:40
Thanks! If I'll get an error then that's what exactly needed. This code needs to run synchronously for other reasons beyond my control. — user3587624
– user3587624, Commented Oct 19, 2018 at 22:48
accessing .Result is almost always wrong - string kvSecret = await kVClient.GetSecretAsync(azureKeyVaultUrl, secret); sounds more likely — Marc Gravell
– Marc Gravell, Commented Oct 19, 2018 at 23:02
if an exception is thrown, the value of kvSecret will be inaccessible; if no exception is thrown, the value is whatever the API returns — Marc Gravell
– Marc Gravell, Commented Oct 19, 2018 at 23:03

Diego Mendes · Accepted Answer · 2018-10-21 20:37:50Z

Unfortunately, the KeyVault client is designed to return an Task with KeyVaultErrorException in case a secret does not exist instead of a failure message\result.

In your case, it blows up because when you call .Result it unwraps the exception within the Task and will break the execution flow.

The best way to retrieve secret in KeyVault is wrapping the logic within a Try\Catch block like below:

try
{
    var secret = await client.GetSecretAsync(secretPath);
    //... any other logic here ...
}
catch (KeyVaultErrorException kvex)
{
    //handle key not found here
}
catch (HttpRequestException ex)
{
    //handle any other error here if needed
}

To make it easier to work with keyvault, I generaly create a class to handle these logic, something like:

public class SecretManager
{
    KeyVaultClient client;
    public SecretManager(KeyVaultClient client){ this.client = client; }

    public Task<string> GetSecretAsync(string secretName){
        //here I wrap the logic mentioned above
    }
}

.

The above snipped is from the top of my head, not a copy from production code

If you use a logic like above, instead of throwing the exception for secret not found, you make the proper exeption handling and return a null value or a value that represent a not found secret, then you will be able to unwrap the results like expected.

Collectives™ on Stack Overflow

Azure KeyVault GetSecretAsync.Result.Value error handling

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related