Storing PayPal credentials in a web application(asp.net) on a shared host

Question

Hi,

I have created a web application that is hosted on Godaddy on a shared server. I plan on using paypal for my transactions, which creates a problem.

At this point the credentials(paypal email and password) are hardcoded, which is as far as I understand the worst solution. The only other option I am aware of is in the web.config file, which again doesn't seem particularly safe.

Can you point me to a direction that would provide the desired security and work in a shared host environment?

Regards Alexandros

Answer 1

On a shared host, the easiest method at least at first glance would be to encrypt the password and store it in your database.

Answer 2

You could store them in the web.config, and then encrypt the web.config file?

Or at very least, encrypt them individually in the web.config?

Answer 3

I think you have following options.

1. Encrypt web.config file

2. Store in database using encryption

3. Create a Class Library and create a class which will hold this information. Now on shared environment, it will be just added as dll inside Bin folder.

Answer 4

Your choices are:

1. Password + signature. You'll have to store it somewhere as plaintext or something decryptable, maybe it be file or database.

2. Password + signature + SSL cert. You'll have to check to see if the hosting service provider lets its users establish SSL connections to other servers (i.e. CURLOPT_SSLCERT in PHP). If you can, use it.

However, regardless of the way you choose, if a hacker can break into your account, he/she will be able retrieve your password, or your cert file.

p.s. please note that the terms "password", "signature", and "SSL cert" are those they refer to in PayPal API references and developer manuals.