CODEWITHSUNDEEP
asp.net
AJM
AJM

Reputation: 32500

ASP.NET Connection String Encryption / Protection

What is best practice for protection/encryption of connection strings in ASP.NET rather than just storing as plain text in Web.Config

Upvotes: 5

Views: 5055

Answers (4)

Joel Coehoorn
Joel Coehoorn

Reputation: 416179

You can set this section to be encrypted.

However, that default encryption has pitfalls pointed out by others. You can also set your connection strings section to point to an external file, and that external file will work in concert with encryption. That should solve most concerns, because the sysadmin can set up encryption there without breaking anything else in the developer's web.config and a devloper can deploy changes to the config without undoing the sysadmin's encryption.

Upvotes: 3

Mitch Wheat
Mitch Wheat

Reputation: 300837

Best Practice is to use Windows Authentication (with the caveat on connection pooling).

Failing that, encrypting connection strings is good practice: Keeping secrets in ASP.NET 2.0.

Note: basic approach does not work with web farms.

Upvotes: 0

Jason Coyne
Jason Coyne

Reputation: 6636

Web.Config has built in support for encrypting connection strings (and other data), but this does have some overhead because the encryption is tied to the server, so the encryption must be set up by a server admin and not the developer.

you could also encrypt manually, with the encryption routine in your source.

Why are you encrypting? Who are you protecting from? Hackers getting access to the web config? Developers that shouldnt know the prod connection string? The reasons behind the encryption will change the solution somewhat.

Upvotes: 1

Steve
Steve

Reputation: 8511

Take a look at Programmatically encrypting a config-file in .NET, it seems to cover this ground.

Upvotes: 4

Related Questions