Hi,

sessions state does not get transmitted to the client.

Do you use 1.1 or 2.0 - in 2.0 encrypted config sections are cached automatically...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hello Jim,

If you keep the decrypted value in Memory, this has three side effect:
The value will most likely be in the page file, any crash dump and is
accessible from any appliation on the server running either under the
same security context or has the debug privilege enabled.

Which database server do you use? If you are running Windows2003 with
SQL Server, you could run the application pool under a special database
access user and access the sql server with integrated authentication. In
this case you woudn't need to encrypt your connetion string. The
database user could then be locked down on the database itself.

The session variable may or may not be transmitted over the wire. If you
are using an out of proess session provider (SQL Server for example) the
session state will be serialized and transferred to the sql server.

But as Mr. Baier points out, the session state is never transmitted to
the client.

The whole thing depends on the amount of security you need. With a
defense-in-depth approach, you should keep the connection string
encrypted most of the time.

Greetings,
Henning Krause