I'm working on a small side-project and I'm using connection strings and also api keys and values that should not be seen or used by other people. I use a public GitHub account for source control. What is the usual method for using source control when these values are in plain text in web.config?
Do I need to remove the values manually before checking in code?
We keep sensitive and/or machine-specific configuration in separate config files, then use configSource to include them like so...
<connectionStrings configSource="cstrings.config"/>
This way you can check in Web.config and a cstrings.config file that has a generic value that can be used on a dev machine. (e.g., (local),...MyAppNameDb...)
For production environments, mark the cstrings.config file as read-only and set up your deployment script so that you don't attempt to write over it. Your production connection string is protected by whatever security you have on that box. This keeps your sensitive strings out of version control.
You can check in a file like config.sample that contains dummy values. Each developer would then copy that file to config and edit in their own values. You would then put this local file in .gitignore.