Question

Is it really a Good Thing to put connection strings with passwords in the app.config file?

It seems to me that the app.config is not encrypted in any way and the password information can be easily read.

I have an app which accesses a database for which the intended end-user have no authentication. A group user/password is used. The application only starts if the current windows user is in an Active Directory group. So, once in the app, the user is allowed to connect to the DB using the group user.

What would be the correct way to handle such connection strings? Hide them in the source code?

NOTE this is for a stand-alone app – not ASP, IIS etc

This worked for me

(thanks to Jon Galloway – http://weblogs.asp.net/jgalloway/archive/2008/04/13/encrypting-passwords-in-a-net-app-config-file.aspx)

private void EncryptConfigSection()
{
    Configuration config = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None);
    ConfigurationSection section = config.AppSettings;
    if (section != null)
    {
        if (!section.SectionInformation.IsProtected)
        {
            if (!section.ElementInformation.IsLocked)
            {
                section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
                section.SectionInformation.ForceSave = true;
                config.Save(ConfigurationSaveMode.Full);
            }
        }
    }
}

This works by encrypting the exe config file the first time the app runs. I haven’t found a way of doing this as part of the installation process so the config file is fully readable until the app is started for the first time. Perhaps someone has an idea…

Answer 1

You can encrypt parts of the app.config or web.config file, see for example this post for more information.

Specifically, this MSDN article walks through various ways of securing connection strings.