How to avoid hardcoded password in web config file in C#

Question

0.00/5 (No votes)

See more:

Name and password information should not be included in a configuration file in plaintext as this will allow anyone who can read the file access to the resource.
    
I want to Encrypt the config file and How to avoid Hardcoded password in Config file?

What I have tried:

<pre><connectionStrings>    
<addname="cs"connectionString="DataSource=myServerAddress;Initial Catalog=myDataBase;User Id=myUsername;Password=XXSDFASFDKD;"/>
</connectionStrings>

Posted 15-Mar-19 1:45am

Jawaharjak

Updated 15-Mar-19 3:09am

v2

Add a Solution

Comments

Richard MacCutchan 15-Mar-19 7:57am

What is the question?

Jawaharjak 15-Mar-19 8:17am

I want to Encrypt the config file and How to avoid Hardcoded password in Config file?

ZurdoDev 15-Mar-19 8:40am

If you google how to encrypt web.config, you'll find a ton of articles on how to do it.

3 solutions

Solution 2

This how we do it. All web applications that connect to a db use windows authentication. We create a service account that the application runs under. This is configured in the application pool assigned to the web application.

Posted 15-Mar-19 2:47am

RmcbainTheThird

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Afzaal Ahmad Zeeshan · Accepted Answer · 2019-03-15T03:09:00

This is not a serious issue, unless you are allowing everybody to see what is written in the file.

<connectionStrings>    
    <addname="cs"connectionString="DataSource=myServerAddress;Initial Catalog=myDataBase; User Id=myUsername; Password=XXSDFASFDKD;"/>
</connectionStrings>

The problem with this approach can come, when you either store these values inside your version control, or you allow everybody to read your production configurations.

I have used some other methods to overcome this problem. Most of the cloud based (and others too) hosting solutions provide environment configuration settings. You can use either that, or you can rewrite the configuration files upon deployment, something like this, https://docs.microsoft.com/en-us/previous-versions/aspnet/dd465326(v=vs.110), or you can use naming convention like web.config and web.Release.config. This way, you will only check-in web.config, and keep the web.Release.config version somewhere safe—if you of course don't trust your developers.

What I did was, I loaded these values on runtime using environment variables, and forwarded them to the type loaders and initializers. This way, I had the production values configured only on the hosting service, and local engineers only see their own system-level configurations. Other than that, there is no problem, and remember, encryption will only exaggerate the problem, instead of solving it—try it to experience it.

Check out this video to understand how, https://www.youtube.com/watch?v=MkcsbM7_2aE

RickZeeland · Accepted Answer · 2019-03-15T02:38:00

Solution 1

See article here: How to Encrypt Web.config Using aspnet_regiis.exe (Framework 4+) Focus on Web Farms[^]
And here: Programmatically Encrypt and Decrypt Configuration Sections in web.config using ASP.NET | DotNetCurry[^]

Posted 15-Mar-19 2:38am

RickZeeland

Updated 15-Mar-19 2:39am

v2