Encrypting the connection string in web.config file in C#

Question

I have written the name of my database, username and password in my web.config file as connection string.

I want to encrypt this data. How can I do it?

<connectionStrings>
  <add name="ISP_ConnectionString" connectionString="Data Source=JIGAR;
             Initial Catalog=ISP;Integrated Security=True;
             User ID=jigar;Password=jigar123;
             providerName="System.Data.SqlClient" />
</connectionStrings>

Might be worth a look: beansoftware.com/ASP.NET-Tutorials/… — Brett
– Brett, Commented Mar 17, 2010 at 13:08

yoel halb · Accepted Answer · 2012-05-14 23:34:35Z

15

You can just use the apnet_regiis tool to do that ,just do

C:\WINDOWS\Microsoft.Net\Framework(64)\(.Net version)\aspnet_regiis -pe "connectionStrings"

for a specific application you can use the app argument -app application name, and for a specific site you can also use the site argument "-site site id".

For more details see http://msdn.microsoft.com/en-us/library/dtkwfdky.aspx.

Note that this works for a web application only and not for a windows application.

Also note that you have to run it from a command prompt with elevated privileges ("run as administrator").

edited May 14, 2012 at 23:34

answered Dec 8, 2011 at 23:27

yoel halb

12.8k3 gold badges59 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Dhanuka777 Over a year ago

It's encrypting the connection string with the DPAPI key, which is specific to a machine. In a webfarm environment, will this work?

yoel halb Over a year ago

@Dhanuka Why shouldn't it?

Dhanuka777 Over a year ago

answering to my own question,well it should work if the encryption is done in both servers separately. The scenario came to my mind was that you cannot use the encrypted webconfig file in Server A to use in server B.

yoel halb Over a year ago

@Dhanuka777 Just to clarify, when you said a "webfarm", you apparently meant to say "server farm" (as opposed to the ASP.Net WebForms framework), and I wold agree that it should work, but need to be encrypted on each machine separately, due to the fact that the encryption is done with the machine key

Black Frog · Accepted Answer · 2010-03-17 13:51:06Z

5

I one particular application, I call the following routine on startup:

Private Sub CheckConfigFile()
    Dim config As System.Configuration.Configuration = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None)
    Dim sec As ConfigurationSection = config.AppSettings

    If sec IsNot Nothing Then
        If sec.SectionInformation.IsProtected = False Then
            Debug.Write("Encrypting the application settings...")
            sec.SectionInformation.ProtectSection(String.Empty)
            sec.SectionInformation.ForceSave = True
            config.Save(ConfigurationSaveMode.Full)
            Debug.WriteLine("done!")
        End If
    End If
End Sub

answered Mar 17, 2010 at 13:51

Black Frog

11.7k1 gold badge37 silver badges67 bronze badges

2 Comments

George Stocker Over a year ago

Encrypting it on application startup doesn't help you if someone breaks into your webserver. It should be encrypted when it's deployed.

Carter Medlin Over a year ago

Excellent. Rather than run this on startup, create a separate ASPX page where you can run this code as needed (right after deployment). For people with "<trust level="Medium" />", temporarily set "<trust level="Full" />" before you run it, and then revert back to "Medium" when done.

Collectives™ on Stack Overflow

Encrypting the connection string in web.config file in C#

2 Answers 2

4 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related