CODEWITHSUNDEEP
asp.net
Tim Scarborough
Tim Scarborough

Reputation: 1290

Encrypting sections of web.config. Should I?

I am responsible for several ASP.NET web apps running on a local Intranet server. Users outside the company aren't supposed to have access to the server, but I don't like leaving anything to chance if it's not necessary. And only admins should have access to the file system.

Should I encrypt the app settings and connection string sections of web.config? I haven't see this mentioned very often, and I was wondering if it's overkill or not a best-practice. I've got passwords in my connection strings and account info for a service account I use to query AD in the app settings.

BTW: I would encrypt using

 Configuration webConfig = WebConfigurationManager.OpenWebConfiguration(System.Web.HttpContext.Current.Request.ApplicationPath);
ConfigurationSection section = webConfig.Sections["connectionStrings"];

if (section != null && !section.SectionInformation.IsProtected)
{
    section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
    webConfig.Save();
}

Upvotes: 1

Views: 327

Answers (2)

Richard
Richard

Reputation: 109100

Should I encrypt the app settings and connection string sections of web.config?

If the connection strings include passwords: then yes, there is no other reasonable option.

If using integrated security to connect to the database, then the information exposure would be database and server names, which is less of an issue. But might be easier to have a deployment rule of always encrypting, because the simpler rule is easier to follow and audit.

You can also use aspnet_regiis.exe to encrypt sections, rather than writing your own code. Enter aspnet_regiis.exe -? into a PowerShell (or cmd) prompt to see options.

Upvotes: 3

Moshe
Moshe

Reputation: 2668

I did something similar for encrypting my web.config file, and I don't regret it. Maintaining it isn't complicated, and it adds yet another layer of defense. Since security is built in layer, there's nothing wrong in doing that.

Upvotes: 1

Related Questions