views:

285

answers:

2

I have written the name of my database, username and password in my web.config file as connection string.

I want to encrypt this data. How can I do it?

<connectionStrings>
  <add name="ISP_ConnectionString" connectionString="Data Source=JIGAR;
             Initial Catalog=ISP;Integrated Security=True;
             User ID=jigar;Password=jigar123;
             providerName="System.Data.SqlClient" />
</connectionStrings>
+3  A: 

Might be worth a look:

http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx

Brett
+3  A: 

I one particular application, I call the following routine on startup:

Private Sub CheckConfigFile()
    Dim config As System.Configuration.Configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None)
    Dim sec As ConfigurationSection = config.AppSettings

    If sec IsNot Nothing Then
        If sec.SectionInformation.IsProtected = False Then
            Debug.Write("Encrypting the application settings...")
            sec.SectionInformation.ProtectSection(String.Empty)
            sec.SectionInformation.ForceSave = True
            config.Save(ConfigurationSaveMode.Full)
            Debug.WriteLine("done!")
        End If
    End If
End Sub
Black Frog
Encrypting it on application startup doesn't help you if someone breaks into your webserver. It should be encrypted when it's deployed.
George Stocker
+1 for giving an answer rather than just a link.
Kirk Broadhurst