CODEWITHSUNDEEP
c#asp.net.netconnection-string
ReiRei
ReiRei

Reputation: 83

Decrypting ConnectionString

I've been reading about encryption and decryption of certain parts of the web.config for C#/ASP applications and I am successful in encrypting the connectionstring of the web.config for my application. My problem is decrypting. I'm using the standard code to encrypt and decrypt but it modifies the web.config. Locally it works fine since when it does modify the web.config I can save it and it will still run but when I upload it to a remote server then it doesn't work.

The error I'm getting is

Configuration Error Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: Failed to decrypt using provider 'RsaProtectedConfigurationProvider'. Error message from the provider: Bad Data

Encrypting

try
{
    Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
    ConfigurationSection section = config.GetSection("connectionStrings");
    if (!section.SectionInformation.IsProtected)
    {
       section.SectionInformation.ProtectSection("RSAProtectedConfigurationProvider");
       config.Save();
    }
    catch (Exception ex)
    { 

    }

Decrypting

Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section = config.GetSection("connectionStrings");
if (section.SectionInformation.IsProtected)
{
    section.SectionInformation.UnprotectSection();
    config.Save();
}

I call the decrypting method whenever the page loads but it doesn't work and it gives me the error above.

I do not have access to the host server at all. So using the command line is not an option.

Upvotes: 2

Views: 5086

Answers (3)

Steve Rowbotham
Steve Rowbotham

Reputation: 2868

You can create and export an RSA Key Container but you'll still need access to the remote server to import the container.

I don't believe that the machineKey element is relevant here BTW. From MSDN:

Key containers with local machine scope (useMachineContainer"true") are stored in a hidden folder at %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys

Upvotes: 1

csm8118
csm8118

Reputation: 1213

I'm guessing the scenario is you're trying to encrypt the web.config locally before pushing it to your hosting provider/remote server. Steve Rowbotham's answer on this question is correct in that you'll need the same RSA Key container on both your development machine and the remote server to be able to encrypt locally and decrypt remotely.

Can you take a different route and encrypt the web.config as part of your deployment process? We use MsDeploy to handle encrypting the config file during deployment and I can provide some sample code if you would like it.

Alternatively, when you application first loads (during the Application_Start event in global.asax) you could check if the connectionStrings section of the web.config is encrypted and then encrypt it. You shouldn't have to decrypt the web.config manually...

Upvotes: 0

SliverNinja - MSFT
SliverNinja - MSFT

Reputation: 31651

Make sure the same decryption key is available on the remote server that you have locally. This would be the machine key element.

Upvotes: 1

Related Questions