Securely storing connection strings in an ASP.NET application

Question

Is storing connection strings in web.config the most secure solution? Is there a way to store them on the server to which they are deployed to, instead (as a system DSN, for example, though I believe those are cumbersome)?.

I'm moving my work codebase to BitBucket, and for some reason am extremely uncomfortable with the idea of having a web.config that contains a database username/password on a machine that I don't have draconian control over. I may just be acting irrationally; never hosted any code externally.

Have you considered integrated security? Then your connection string don't have to contain such sensitive information. — Peter Lillevold
– Peter Lillevold, Commented Oct 6, 2011 at 6:50

Arun · Accepted Answer · 2011-10-05 21:33:17Z

5

You can encrypt sections of your web.config. You could do that for the ConnectionStrings Section. MSDN link available here.

answered Oct 5, 2011 at 21:33

Arun

2,55316 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Darin Dimitrov · Accepted Answer · 2011-10-05 21:31:19Z

2

If you are concerned about the security of your connection strings you have the possibility to encrypt them.

answered Oct 5, 2011 at 21:31

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Comments

Peter Bromberg · Accepted Answer · 2011-10-06 01:04:35Z

1

Personally I think this case is overblown. ASP.Net by default will never serve your web.config file no matter how hard a determined hacker tries to get it.

answered Oct 6, 2011 at 1:04

Peter Bromberg

1,5148 silver badges12 bronze badges

2 Comments

Peter Lillevold Over a year ago

The question is: when a hacker gets access to the computer through some other hole, what will he or she find? A username and password in the clear? Great, now they have easy access to all your data too.

Levi Over a year ago

Regardless, it never hurts to have defense-in-depth mechanisms.

Collectives™ on Stack Overflow

Securely storing connection strings in an ASP.NET application

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related