Storing db connection strings

Question

Whats the preferred file (and why do you prefer it) to store database connection strings in an ASP.Net application, where security is the primary issue?

Thanks

Answer 1

The preferred way? Don't!

Used a trusted connection and Windows principal.

In connection string, either:

Trusted_Connection = Yes

or

Integrated Security = SSPI (or True)

Answer 2

You can store the connection strings in your <connectionStrings> section of web.config, and then encrypt that section by using aspnet_regiis (in your C:\Windows\Microsoft.NET\Framework\v2.0.50727 directory):

aspnet_regiis.exe -pef "connectionStrings" C:\yourproject\YourWebSite

aspnet_regiis has a multitude of config parameters - the -pef allows you to specify the physical path where your website project is (and find the web.config file in that path and encrypts the connectionStrings section inside it).

Or you could also possibly store things like server name (and database name, if that's configurable and could change) separately, in a config, and only build up your connection string at runtime in memory and never even store the whole connection string anywhere. But as soon as you have sensitive information like this, stored in a config file, you are well advised to encrypt it.

Marc