{"record":{"id":"91460593bcbf71a7","repo":"abpframework/abp","slug":"blob-encryption-is-enabled-but-no-passphrase-coul","errorCode":null,"errorMessage":"BLOB encryption is enabled, but no passphrase could be resolved. Pass a passphrase to the UseEncryption extension method or configure AbpBlobStoringEncryptionOptions.DefaultPassPhrase.","messagePattern":"BLOB encryption is enabled, but no passphrase could be resolved\\. Pass a passphrase to the UseEncryption extension method or configure AbpBlobStoringEncryptionOptions\\.DefaultPassPhrase\\.","errorType":"exception","errorClass":"AbpException","httpStatus":null,"severity":"error","filePath":"framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/DefaultBlobEncryptionKeyProvider.cs","lineNumber":43,"sourceCode":"    public virtual Task<BlobEncryptionKey> ResolveForEncryptionAsync(\n        [NotNull] BlobEncryptionKeyContext context,\n        CancellationToken cancellationToken = default)\n    {\n        Check.NotNull(context, nameof(context));\n        cancellationToken.ThrowIfCancellationRequested();\n\n        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);\n        if (!string.IsNullOrWhiteSpace(containerPassPhrase))\n        {\n            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Container, containerPassPhrase!));\n        }\n\n        if (!string.IsNullOrWhiteSpace(Options.DefaultPassPhrase))\n        {\n            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Global, Options.DefaultPassPhrase!));\n        }\n\n        throw new AbpException(\n            \"BLOB encryption is enabled, but no passphrase could be resolved. \" +\n            \"Pass a passphrase to the UseEncryption extension method or configure \" +\n            $\"{nameof(AbpBlobStoringEncryptionOptions)}.{nameof(AbpBlobStoringEncryptionOptions.DefaultPassPhrase)}.\"\n        );\n    }\n\n    /// <inheritdoc />\n    public virtual Task<string> ResolveForDecryptionAsync(\n        BlobEncryptionKeySource keySource,\n        [NotNull] BlobEncryptionKeyContext context,\n        CancellationToken cancellationToken = default)\n    {\n        Check.NotNull(context, nameof(context));\n        cancellationToken.ThrowIfCancellationRequested();\n\n        string? passPhrase;\n        switch (keySource)\n        {","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/DefaultBlobEncryptionKeyProvider.cs#L25-L61","documentation":"DefaultBlobEncryptionKeyProvider.ResolveForEncryptionAsync tries the container-level passphrase first, then AbpBlobStoringEncryptionOptions.DefaultPassPhrase. If neither is set (both null/whitespace) while encryption is enabled for the container/BLOB, no key can be derived and it throws AbpException describing both fix paths.","triggerScenarios":"Saving a BLOB to a container configured with UseEncryption() but with no per-container passphrase passed to UseEncryption and no DefaultPassPhrase set in AbpBlobStoringEncryptionOptions.","commonSituations":"Forgot to configure DefaultPassPhrase in appsettings/startup; container configured for encryption in one module but the passphrase configured in another module that didn't load; passphrase left empty in the secret store; module-load ordering issue.","solutions":["Set AbpBlobStoringEncryptionOptions.DefaultPassPhrase globally in Configure<AbpBlobStoringEncryptionOptions>.","Pass a passphrase explicitly to UseEncryption(passphrase) for the container.","If passphrases are tenant/externally sourced, replace IBlobEncryptionKeyProvider with a custom implementation that resolves them.","Verify the configuration module actually runs before any BLOB save (check DI/module loading order)."],"exampleFix":"// before — encryption enabled, no passphrase anywhere\nConfigure<AbpBlobStoringOptions>(o =>\n    o.Containers.Configure<MyContainer>(c => c.UseEncryption()));\nawait blob.SaveAsync(\"x\", bytes); // throws [99]\n\n// after — set a global default passphrase\nConfigure<AbpBlobStoringEncryptionOptions>(o =>\n    o.DefaultPassPhrase = Environment.GetEnvironmentVariable(\"BLOB_PASSPHRASE\")\n        ?? throw new InvalidOperationException(\"BLOB_PASSPHRASE not set\"));\n// or per-container:\n// c.UseEncryption(opts => opts.PassPhrase = \"...\");","handlingStrategy":"validation","validationCode":"// Startup assertion: encryption is configured with a real passphrase.\nstatic void AssertEncryptionConfigured(\n    AbpBlobStoringOptions storing,\n    AbpBlobStoringEncryptionOptions encryption)\n{\n    bool anyEncrypted = storing.Containers.GetConfigurations()\n        .Any(c => c.Configuration.GetBlobEncryptionEnabled());\n    if (anyEncrypted && string.IsNullOrWhiteSpace(encryption.DefaultPassPhrase))\n        throw new InvalidOperationException(\n            \"BLOB encryption is enabled but no DefaultPassPhrase is set \" +\n            \"and no container-level passphrase was provided.\");\n}","typeGuard":"public sealed record NonBlankPassphrase\n{\n    public string Value { get; }\n    public NonBlankPassphrase(string? value)\n    {\n        Value = string.IsNullOrWhiteSpace(value)\n            ? throw new ArgumentException(\"passphrase required\")\n            : value;\n    }\n}\n// Configure<AbpBlobStoringEncryptionOptions>(o => o.DefaultPassPhrase = new NonBlankPassphrase(env).Value);","tryCatchPattern":"try\n{\n    await blob.SaveAsync(name, data);\n}\ncatch (AbpException ex) when (ex.Message.Contains(\"no passphrase could be resolved\"))\n{\n    logger.LogCritical(ex, \"Encryption enabled but no passphrase configured; set DefaultPassPhrase or pass one to UseEncryption.\");\n    // Not retryable until config is fixed.\n    throw;\n}","preventionTips":["Set AbpBlobStoringEncryptionOptions.DefaultPassPhrase in startup (e.g. from a secret).","Pass an explicit passphrase to UseEncryption for per-container keys.","Add a startup assertion that resolves a passphrase whenever encryption is enabled.","Verify the module that configures encryption runs before any BLOB save (DI/module order)."],"tags":["crypto","configuration","passphrase","di"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}