CODEWITHSUNDEEP
asp.netweb-configconnection-string
Mikayil Abdullayev
Mikayil Abdullayev

Reputation: 12376

How safe is it to keep connection string in configuration file

I've seen so many people keep their connection strings in the web.config file, instead of hard coding it. But I find it very dangerous, especially in cases where the same connection string is used for all users. This means anyone who's got access to the web config file can easily get the username and password to the database and do all kinds of serious things. Is being able to modify the connection string without digging into the code worth this trade off? Is there any other benefit of keeping connection string in configuration file?

Upvotes: 2

Views: 3061

Answers (2)

Sumit Gupta
Sumit Gupta

Reputation: 2192

Web.config based connectionstring as seems is unsafe, because one can read it. But think about it, if a person can read your web.config, means he can edit any file on your server anyways as he probably already hack or gain access to file. So, it really doesn't matter much. But to ensure some more safety you can do following:

  1. Encrypt your Connection String and put that encrypted string in Web.config and then Decrypt it and read through a DLL file.

  2. Create a DLL and put Connection String in that DLL, later add reference to that DLL and use connection string.

However using Web.config will allow you to change connection string based on your need. Like I have to run site at 5 different server, for development, testing production purpose, so I put different web.config everywhere rather than changing Code all time. So, based on your need and how your server is configured one or other method is always good or bad.

Upvotes: 5

Ravi Gadag
Ravi Gadag

Reputation: 15881

you can encrypt your web.config key. read here for more Encrypt web.config

aspnet_regiis -pe "connectionStrings" -app "/SampleApplication"

Encrypt web.config

Upvotes: 1

Related Questions