What is best practice for protection/encryption of connection strings in ASP.NET rather than just storing as plain text in Web.Config
1
-
possible duplicate of Programmatically encrypting a config-file in .NETT.J. Crowder– T.J. Crowder2014-08-01 07:44:21 +00:00Commented Aug 1, 2014 at 7:44
Add a comment
|
4 Answers
Take a look at Programmatically encrypting a config-file in .NET, it seems to cover this ground.
Comments
You can set this section to be encrypted.
However, that default encryption has pitfalls pointed out by others. You can also set your connection strings section to point to an external file, and that external file will work in concert with encryption. That should solve most concerns, because the sysadmin can set up encryption there without breaking anything else in the developer's web.config and a devloper can deploy changes to the config without undoing the sysadmin's encryption.
Comments
Web.Config has built in support for encrypting connection strings (and other data), but this does have some overhead because the encryption is tied to the server, so the encryption must be set up by a server admin and not the developer.
you could also encrypt manually, with the encryption routine in your source.
Why are you encrypting? Who are you protecting from? Hackers getting access to the web config? Developers that shouldnt know the prod connection string? The reasons behind the encryption will change the solution somewhat.
Comments
Best Practice is to use Windows Authentication (with the caveat on connection pooling).
Failing that, encrypting connection strings is good practice: Keeping secrets in ASP.NET 2.0.
Note: basic approach does not work with web farms.
