Is storing connection strings in web.config the most secure solution? Is there a way to store them on the server to which they are deployed to, instead (as a system DSN, for example, though I believe those are cumbersome)?.
I’m moving my work codebase to BitBucket, and for some reason am extremely uncomfortable with the idea of having a web.config that contains a database username/password on a machine that I don’t have draconian control over. I may just be acting irrationally; never hosted any code externally.
You can encrypt sections of your web.config. You could do that for the ConnectionStrings Section. MSDN link available here.