Asp.net ConnectionString in secure way

Question

I could not get a satisfactory answer to my question on the google, they are:

How secure ConnectionString is over the HttpRequest?
Is using ConnectionString in web.config file more secure than using in any specific aspx page?
And how to secure ConnectionString for highly secure website?

I'm just curious to know about this.

web.config is safe, IIS will not serve this file to the client. — Bazzz
– Bazzz, Commented Mar 28, 2012 at 13:02
@AshwiniVerma: Note that encrypting might secure your web.config more but only for people who have anyway access to read it on the server. No configuration file will be sent via network. — Tim Schmelter
– Tim Schmelter, Commented Mar 28, 2012 at 13:12
@AshwiniVerma: Specify hacker. If this person belongs to the group which has read access on your server, your problem might not be solved ;) — Tim Schmelter
– Tim Schmelter, Commented Mar 28, 2012 at 13:26
That can help but it might be easier (if applicable) to use integrated security and not store username/password in cleartext at all. More important is to secure your network and server in general.(firewalls,service-packs/patches,minimum software,separate db and webserver, closed db-ports, ...) — Tim Schmelter
– Tim Schmelter, Commented Mar 28, 2012 at 13:39

Oded · Accepted Answer · 2012-03-28 13:23:03Z

8

You can encrypt the conenction string inside the webconfig, here is an article from Microsoft about this topic : http://msdn.microsoft.com/en-us/library/dx0f3cf2(v=vs.80).aspx

If you sending the connectionstring over a channel its not more secure than the channel. For example sending the connectionstring over HTTP and it will be just plain text, HTTPS and it will be encrypted, over FTP just plan text, and so on...

If you have a webapplication in a shared hosted environment you should be worried about that the provider maybe get hacked.

So just keep the connection string inside the web.config and encrypt it and don't send it around on internet ;-)

edited Mar 28, 2012 at 13:23

Oded

501k102 gold badges900 silver badges1k bronze badges

answered Mar 28, 2012 at 13:03

Simon Edström

6,6178 gold badges34 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Aristos Over a year ago

in local connection you do not even need to encrypt it, just select Integrated Security=True <add name="OneConnection" connectionString="Data Source=localhost;Initial Catalog=TheDB;Integrated Security=True;" providerName="System.Data.SqlClient" /> Even if you read that, you have nothing to do it.

Ashwini Verma Over a year ago

@Aristos: but it is not local server.

Daniel A. White · Accepted Answer · 2012-03-28 13:02:30Z

4

The connection strings are safe in the web.config. They are very secure unless you print them out on the web requests.

answered Mar 28, 2012 at 13:02

Daniel A. White

192k49 gold badges389 silver badges474 bronze badges

2 Comments

oleksii Over a year ago

Could you explain a bit here, you probably meant something more, as I am sure you are well aware that storing plain text conn string in a web config is not drastically secure, as config file can be downloaded (through hundreds of vulnerabilities) remotely and read directly as plain text

Ashwini Verma Over a year ago

@oleksii: yes you are right. that's why looking forward to now more about this.

Smack · Accepted Answer · 2012-03-28 13:27:42Z

3

Nice project on CodePlex Encrypt/Decrypt Connection string

answered Mar 28, 2012 at 13:27

Smack

9461 gold badge13 silver badges31 bronze badges

Comments

Fraz Sundal · Accepted Answer · 2012-03-28 13:02:22Z

2

There are quite a few methods to secure your connectionstring like

Encrypt your connectionstring and save it in webconfig
Encrypt your connectionstring and save it in windows registry

Its best to save connectionstring in webconfig to be used as a single point of use for whole application.

answered Mar 28, 2012 at 13:02

Fraz Sundal

10.5k22 gold badges87 silver badges133 bronze badges

Comments

Oded · Accepted Answer · 2012-03-28 13:03:15Z

How secure ConnectionString is over the HttpRequest?

It is a string. It is only as secure as the connection is, so, normally not at all. This is assuming you are sending the connection string details over a HttpRequest. If this is not the case and your connection string is used in the web.config, it is as safe as the file itself and IIS are.

Is using ConnectionString in web.config file more secure than using in any specific aspx page?

No.

And how to secure ConnectionString for highly secure website?

Normally, one uses integrated security (windows authentication) to avoid hard coding of a username and password. Additionally, you can encrypt the configuration section, as described here (RSA) and here (DPAPI).

Shyju · Accepted Answer · 2012-03-28 13:04:44Z

How secure ConnectionString is over the HttpRequest?

Do you send the connection string over http request ? Really ? what scenario it is ? Ususally only requests for a webpage travels thru http request and the response as well. Connectionstring is something your code internally use to access data and it stays in your server.

Is using ConnectionString in web.config file more secure than using in any specific aspx page?

Think about maintainability. If you put your connection string in a class, you have to rebuild your app when you have to change your connection string . If some body has access to your folder where you have your files, they can use a disassembler to see what is in your dlls.

And how to secure ConnectionString for highly secure website?

You can encrypt connection string in web.config. check this link http://www.codeproject.com/Tips/304638/Encrypt-or-Decrypt-Connection-Strings-in-web-confi

dash · Accepted Answer · 2012-03-28 13:05:18Z

To answer your questions in turn:

How secure ConnectionString is over the HttpRequest?

You should never have to pass your connection string over HTTP; what usually happens is a user makes a request, your site processes the request including connecting to the database, and returns the result to the client. Connection String should not be sent over HTTP in this scenario.

Is using ConnectionString in web.config file more secure than using in any specific aspx page?

Depends on what you do with the connection string - if you ever write it out to the client then it's never going to be secure! The connection string is usually placed into config for reusability purposes; embedding it on every page makes for a lot more maintainance and potential bugs.

And how to secure ConnectionString for highly secure website?

You can encrypt the connection - so it is never stored as plain text, or use Windows Authentication so you never need a password. This is supported by ASP.Net as described here and here.

Collectives™ on Stack Overflow

Asp.net ConnectionString in secure way

7 Answers 7

2 Comments

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

2 Comments

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related