ConnectionStrings in app.config. What about security?

Question

Is it really a Good Thing to put connection strings with passwords in the app.config file?

It seems to me that the app.config is not encrypted in any way and the password information can be easily read.

I have an app which accesses a database for which the intended end-user have no authentication. A group user/password is used. The application only starts if the current windows user is in an Active Directory group. So, once in the app, the user is allowed to connect to the DB using the group user.

What would be the correct way to handle such connection strings? Hide them in the source code?

NOTE this is for a stand-alone app - not ASP, IIS etc

This worked for me

(thanks to Jon Galloway - http://weblogs.asp.net/jgalloway/archive/2008/04/13/encrypting-passwords-in-a-net-app-config-file.aspx)

private void EncryptConfigSection()
{
    Configuration config = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
    ConfigurationSection section = config.AppSettings;
    if (section != null)
    {
        if (!section.SectionInformation.IsProtected)
        {
            if (!section.ElementInformation.IsLocked)
            {
                section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
                section.SectionInformation.ForceSave = true;
                config.Save(ConfigurationSaveMode.Full);
            }
        }
    }
}

This works by encrypting the exe config file the first time the app runs. I haven't found a way of doing this as part of the installation process so the config file is fully readable until the app is started for the first time. Perhaps someone has an idea...

Answer 1

You can encrypt parts of the app.config or web.config file, see for example this post for more information.

Specifically, this MSDN article walks through various ways of securing connection strings.

Answer 2

Also, which version of IIS are you running? Is this shared hosting? Or do you have administrator access to IIS? If so, go check out your IIS ASP.NET settings in IIS Manager. You can specify ConnectionStrings.

Answer 3

You should use Integrated authentication, and having the AppPool user authenticated on the SQL with just what he needs to execute.

with that, you do not need to provide the password in the config, and the connection uses the app pool user to authenticate against the sql server.

therefore you have the highest security.