Where do you store your connection strings?

Question

In all my VB6 applications, connection information was stored in encrypted fields in the database. Nobody has access to the database and if anyone did, all they would get to see was a bunch of encrypted values.

There was always a flaw with this method. Fetching the connection information required using a hard-coded id/password in the application that would fetch this connection information and form a string.

In the .NET world, I am currently storing this hard-coded id / password in app.exe.config file. The recommended method is to encrypt the connection string in the file?

Which classes can I use to do this encryption / decryption?

Answer 1

Encrypt Connection Strings in VS 2005 .config Files

Answer 2

Read:

Encrypting Configuration Information in ASP.NET 2.0 Applications

Basically, the ASP.NET infrastructure has the tools you need to encrypt, and the .NET configuration subsystem knows how to decrypt when needed - so there's really all already in there, ready for you to use!

To encrypt, you'd use the aspnet_regiis utility, something like this:

aspnet_regiis.exe -pef "connectionStrings" "C:\Inetpub\wwwroot\MySite" 

And for decryption - nothing needs to be done, .NET handles this transparently for you.

UPDATE: those mechanisms for for ALL of .NET - they are part of the basic infrastructure of .NET. You can use these techniques and recipes for your console app or Windows service. Microsoft only provides tooling for the ASP.NET case to encrypt sections of web.config - but the API's and calls are there for everyone to use, in any kind of .NET app - done it myself, in anything from a console app, to a Windows service.

I have a small utility on my SkyDrive that comes with full .NET source that shows you how to encrypt any section of any .NET config file. Feel free to check that out and use it in your endeavours any way you see fit.