How secure are appsettings in web.config?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Tim Wood - 25 Nov 2003 14:36 GMT

Just wondering how safe it is to include sensitive information such as a
database connection string in web.config.

Reply to this Message

Cowboy \(Gregory A. Beamer\) - 25 Nov 2003 15:54 GMT

In theory, very safe, as the config file is tied to the ASP.NET runtime. In
reality, who knows? Hackers are going to look for this type of information
and it is open text (in the 1.0/1.1 framework, at least). I would encrypt;
there are some good articles on MSDN for using the machine key to encrypt
secrets. In fact, the http://msdn.microsoft.com/architecture site has a
treasure trove of books on a variety of topics.

Signature

Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

**********************************************************************
Think Outside the Box!
**********************************************************************

> Just wondering how safe it is to include sensitive information such as a
> database connection string in web.config.

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...