Click here to Skip to main content
15,861,168 members
Articles / Web Development / ASP.NET
Article

Enhanced and Secure Connection Strings in Web.Config

Rate me:
Please Sign up or sign in to vote.
2.25/5 (28 votes)
25 Jan 2003CPOL2 min read 150K   1.9K   61   12
Here we would discuss some simple steps, which would facilitate keeping our database connection strings safe and encrypted in Web.Config.

Introduction

In developing ASP.NET applications, we make heavy use of Web.Config to store and retrieve database connection strings. But we need to be aware of the fact that Web.Config is a simple XML text file and its contents are readable by any user having access to the the webserver's file system. Albeit the fact that accesses like http://localhost/deepak/web.config etc. are halted by the webserver with a message 'The type of page is not served', anybody with console access to the system can still open and read the database connection strings, which might contain the password to the database in an unencrypted manner.

Simple encryption

After a great deal of search in MSDN and other sites, I found a simple way to encrypt strings using a minimum of 8 character string (8 characters should be okay since even MSN Hotmail recommends a minimum of 8 character passwords for all accounts). Sections have been taken from ASPAlliance example but the method has been kept as a static method for the simple reason that you need not create object for every encryption and decryption strategy.

The attached example makes use of DESCryptoServiceProvider that is available in System.Security.Cryptography namespace.

Enhancement

For example sake, I have given both the key and the encrypted string in web.config. But for security reasons, it would be advisable to keep the key elsewhere in the file system and read the key dynamically from this file from the specified location. Additional care has to be taken that the place where we store the key is accessible only to System Administrators and other authorized personnel. With this strategy and trick in place, the database connection string could be made relatively safe for a particular web application.

How to use the example

Include the following two lines in web.config:

XML
<add key="cKey" value="LavanyaDeepak"/>
<add key="cDb" value="C0AHny7FDFewTPE7eTp5RA=="/>

To any of your test applications, unzip the files in the archive (Cryptography.cs and Test.Aspx and Test.Cs). Include them in a project in Visual Studio .NET. Build the application and run test.aspx from the web browser.

Conclusion

I hope the above article would be very useful for .NET developers worldwide to make effective and secure use of database connection strings that are put in Web.Config. Many thanks to developers whose ideas and pieces of code have been helping me out in drafting these static methods.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Software Developer
India India
Vasudevan Deepak Kumar is from Chennai, India who has been in the programming career since 1994, when he was 15 years old. He has his Bachelors of Engineering (in Computer Science and Engineering) from Vellore Engineering College. He also has a MBA in Systems from Alagappa University, Karaikudi, India.
He started his programming career with GWBasic and then in his college was involved in developing programs in Fortran, Cobol, C++. He has been developing in Microsoft technologies like ASP, SQLServer 2000.
His current focus is ASP.NET, C#, VB.NET, PHP, SQL Server and MySQL. In his past-time, he listens to polite Carnatic Music. But the big question is that with his current Todolist backlog, does he get some past time?

Comments and Discussions

 
Generallogin.aspx Pin
Ajay Kale New27-Sep-10 0:06
Ajay Kale New27-Sep-10 0:06 
GeneralDeveloper Caste System Pin
shitba13-Jan-06 5:12
shitba13-Jan-06 5:12 
GeneralThe encryption code Pin
durayakar12-Nov-03 16:41
durayakar12-Nov-03 16:41 
Generalhmm ... Pin
krumpo28-Jan-03 0:52
krumpo28-Jan-03 0:52 
GeneralRe: hmm ... Pin
Eli Allen30-Jan-03 14:10
Eli Allen30-Jan-03 14:10 
GeneralRe: hmm ... Pin
Vasudevan Deepak Kumar30-Jan-03 16:42
Vasudevan Deepak Kumar30-Jan-03 16:42 
GeneralRe: hmm ... Pin
Eli Allen31-Jan-03 1:22
Eli Allen31-Jan-03 1:22 
GeneralRe: hmm ... Pin
ThePhoenix8-Jul-03 22:20
ThePhoenix8-Jul-03 22:20 
GeneralRe: hmm ... Pin
Anonymous22-Feb-05 10:27
Anonymous22-Feb-05 10:27 
GeneralRe: hmm ... Pin
Anonymous12-Oct-05 7:19
Anonymous12-Oct-05 7:19 
GeneralRe: hmm ... Pin
shahp4-Jan-06 7:26
shahp4-Jan-06 7:26 
GeneralCool Idea Pin
Heath Stewart26-Jan-03 4:56
protectorHeath Stewart26-Jan-03 4:56 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.