How to protect the connectionstring in web.config?

Question

Hi, I have a website about to go live. I'm wondering what I should be doing about the connectionstring in the web.config. Do I obfuscate it and it so how?

Thanks!

Answer 1

You can encrypt the <connectionStrings> section in your web.config - see How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI

Answer 2

The standard method is to encrypt it. http://ondotnet.com/pub/a/dotnet/2005/02/15/encryptingconnstring.html

However, another good option is to store it in the registry and set the permissions so that only the asp.net runtime can access it.

See this article: http://msdn.microsoft.com/en-us/library/ff649224.aspx and this KB: http://support.microsoft.com/kb/821616

Although I do have to say that using the registry does tend to complicate deployment and using text/staging servers a bit. We did it... ONCE and then went back to encrypting.

Answer 3

Since you didn't provide any information about this in your question I will assume you have credentials in your connection string.

From a security perspective you should try to avoid this, use Windows Authentication if possible. Obviously this requires that you have access to an Active Directory environment and all the servers are deployed in it.

If not, it's always better to lock down the web-server instead of trying to make sure that files on disk are secure from tampering by different users.

If even this is not possible then I would follow the approach given by the other replies, encrypting the sensitive content with DPAPI.