Explain risks of password in JSON file

[Rick-Anderson]

Document makes extensive use of "Password": "<certificate password>"

Need to explain should only be used with localhost and the PW shouldn't be used in test or production.

See this GitHub comment

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 312df0ba-e769-c904-40b2-733c291704a0
• Version Independent ID: fd9cc0c2-3ea3-f437-e0ac-8789fb96faf7
• Content: Configure endpoints for the ASP.NET Core Kestrel web server
• Content Source: aspnetcore/fundamentals/servers/kestrel/endpoints.md
• Product: aspnet-core
• Technology: aspnetcore-fundamentals
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[serpent5]

@Rick-Anderson Do you know if there's an example of similar messaging and its formatting I can use as a guide for handling this issue?

[Rick-Anderson]

Copy from https://docs.microsoft.com/en-us/aspnet/core/security/app-secrets

The problem is that our guidance is never use passwords in files that can be checked into GitHub. I would show them how to exclude the file from GitHub.
Replace <certificate password> with $CREDENTIAL_PLACEHOLDER$. You can tell them in the text that $CREDENTIAL_PLACEHOLDER$ is the certificate password.