Home / Questions / 38289
Accepted
Cristina Carrasco
Asked: 2020-12-09 17:39:51 +0800 CST 2020-12-09 17:39:51 +0800 CST

Save the connection in app.config in an encrypted way

  • 772

Is it possible to save a connection string from app.config without saving the password, or somehow encrypt it, using entity framework? Without using windows authentication, that is, with username and password.

Connection example:

<add name="conexionEntities" connectionString="metadata=res://*/Integration.Models.conexion.csdl|res://*/Integration.Models.conexion.ssdl|res://*/Integration.Models.conexion.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=(local);initial catalog=db_ejemplo;user id=sa;password=123456789;multipleactiveresultsets=True;App=EntityFramework&quot;" providerName="System.Data.EntityClient" />

password=123456789 <-- this data is the one that I would not like to be exposed in the app.config

c#

1 Answers

  1. Best Answer

    You can encrypt parts ofWeb.config it as shown in the link to prevent that information from being accessed.

    EDIT

    Example of the encryption process:

    1. Edit the Web.configwith a text editor. Make sure it <system.web>contains the child elements: <connectionStrings>and <machineKey>. An example could be:
    <configuration>
   <connectionStrings>
      <add name="SqlServices" connectionString="Data Source=localhost;Integrated Security=SSPI;Initial Catalog=Northwind;" />
   </connectionStrings>
   <system.web>
     <machineKey validationKey="D61B3C89CB33A2F1422FF158AFF7320E8DB8CB5CDA1742572A487D94018787EF42682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE"
       decryptionKey="FBF50941F22D6A3B229EA593F24C41203DA6837F1122EF17" />
   </system.web>
</configuration>

    1. With the command prompt go to:cd \WINDOWS\Microsoft.Net\Framework\v2.0.*

    2. Once there, run the following command: aspnet_regiis -pe "connectionStrings" -app "/MyApplication". This command encrypts the <connectionStrings>application section MyApplication.

    3. Repeat the previous step for the element <machineKey>:aspnet_regiis -pe "system.web/machineKey" -app "/MyApplication"

    Now the content of the Web.config is already encrypted.

    EXTRA

    Access to encrypted data:

    Although ASP.NET automatically decrypts the file content Web.configwhen it is processed and no additional steps are needed to read the file, it may be interesting to know how to view the decrypted information. To access it, it can be done through these lines of code.

      Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
  MachineKeySection key = 
    (MachineKeySection)config.GetSection("system.web/machineKey");
    • 9