CODEWITHSUNDEEP
c#.netwpfsql-server-2008encryption
Claudiu Constantin
Claudiu Constantin

Reputation: 2218

Connection String management for a desktop application

I created a desktop application in C#/WPF which connects to a SQL Server 2008 instance through a constant connection string specified in code as follows (for testing purposes):

private string GetConnectionString()
{
    //test
    return "Data Source=[server IP]; Initial Catalog=[database name]; User ID=[user ID]; Password=[smart password];";
}

The application will be used by various users and will be deployed via ClickOnce, a .zip archive or a custom installer. It also has a separated custom login functionality by requesting an application-access username and password.

Which is the best practice to store the connection string details for my desktop application (IP, database, SQL Server user, password)? If the connection string changes over night, which is the best method to update it without forcing users to update to the latest version of my application? Users should not be able to see/intercept/decompile the connection string, so I guess I must use some sort of encryption. Do you have any kind of suggestion for my inquiry?

Upvotes: 3

Views: 5562

Answers (5)

paparazzo
paparazzo

Reputation: 45096

If the client is connecting to the database then the connection can be hacked.

This is a sample of connection data in App.Config 

    <appSettings>
        <add key="dbServer" value="svr"/>
        <add key="dbDataBase" value="db1"/>
        <add key="dbUser" value="sharedUser"/>
        <add key="dbPassword" value="easyPassword"/>
     </appSettings>

Need a reference to system.configuration

        string SvrName = ConfigurationManager.AppSettings["dbServer"];
        string DBName = ConfigurationManager.AppSettings["dbDataBase"];
        string DBUser = ConfigurationManager.AppSettings["dbUser"];
        string DBPassword = ConfigurationManager.AppSettings["dbPassword"];

As for security the answer is a 2 tier application where only the secure server side code connects to the database. This code sample from server side code.

The other benefits of server side is repeated queries from the same connection can gain from indexes in memory from prior query.

You could salt and hash the password read from the AppSettings and obsfuscate the application but you would have to use a static salt so it could be hacked. It would just slow down the hacker.

Upvotes: 2

Andrei R&#238;nea
Andrei R&#238;nea

Reputation: 20780

My opinion is that the safest solution is to have a local DNS entry point to the current SQL machine and the authentication to be Windows authentication.

For example : SQLMACHINE host name pointed to 192.168.1.3 in the DNS server.

This way if the name/IP of the SQL machine changes, only the DNS server needs updated (and possibly the local DNS caches to be invalidated).

Having Windows authentication means that no password will be stored on the local machine so you can safely store the connection string in the .config file with no worries.

My 2 (euro)cents.

Upvotes: 1

Yuriy Guts
Yuriy Guts

Reputation: 2220

Even if you compile your connection strings into the application, they still can be viewed using the Ildasm.exe (MSIL Disassembler) tool because strings are a part of assembly's metadata.

Maybe this question can help you.

Upvotes: 5

Induster
Induster

Reputation: 733

You need to add an "Application Settings" file to your application. Just right click on your solution -> add -> find something similar to "app configuration". In order to do this you will need some kind of external config file to store the connection string. You could even use a simple file. If worried about people finding the file, you can always encrypt the string and decrypt it in your app.

Upvotes: 1

to StackOverflow
to StackOverflow

Reputation: 124696

In a desktop application, you can't prevent a determined user from seeing the connection string. Even if you use encryption, a determined user will be able to find and use the encryption key.

Upvotes: 3

Related Questions