What is the best practice for encrypting the connectionStrings section in the web.config file when using LINQ TO SQL?
1
-
is this totally necessary? IIS will not serve your Web.config so no one can read it unless they compromise your server. If you're still worried about it, you could use some RijndaelManaged to encrypt the string in your config and then build a class to decrypt it before LINQ touches it. msdn.microsoft.com/en-us/library/…Chase Florell– Chase Florell2010-05-31 04:49:22 +00:00Commented May 31, 2010 at 4:49
Add a comment
|
2 Answers
First of all, encrypting section in web.config/app.config is not specific to just Linq2Sql. .Net framework comes with special set of classes that lets you independantly encrypt/decrypt parts of web.config/app.config.
You can encrypt sections of your web.config using DPAPI provider. Nothing else need to change in your application. you still keep reading appsettings and conn. strings as usual. Use this code below to encrypt/decrypt parts of your config file.
//call: ProtectSection("connectionStrings","DataProtectionConfigurationProvider");
private void ProtectSection(string sectionName, string provider)
{
Configuration config =
WebConfigurationManager.
OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section = config.GetSection(sectionName);
if (section != null && !section.SectionInformation.IsProtected)
{
section.SectionInformation.ProtectSection(provider);
config.Save();
}
}
//call: UnProtectSection("connectionStrings");
private void UnProtectSection(string sectionName)
{
Configuration config =
WebConfigurationManager.
OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section = config.GetSection(sectionName);
if (section != null && section.SectionInformation.IsProtected)
{
section.SectionInformation.UnprotectSection();
config.Save();
}
}
answered May 31, 2010 at 5:02
this. __curious_geek
43.2k22 gold badges117 silver badges137 bronze badges
2 Comments
marc_s
or use the built-in aspnet_regiis utility to encrypt/decrypt .NET config file sections....
this. __curious_geek
encryption using DPAPI uses local machineKey which is specific to local machine. When you deploy your app on server you might not have access to aspnet_regiis tool on server, or you might need to provide machineKey section in your web.config/app.config. So I'd recommend you do it by code.
If you feel the need to do so, you can just simply encrypt the <connectionStrings> section of your web.config file - it's a standard .NET procedure, all .NET code can deal with it - no problems:
or Google or Bing for it - you'll get thousands of hits.....
