Question

Ive been asked to fix a security issue for a webbapplication. The issue is that the webbapplication uses impersonation in the web config to log on to a domain. If the password is incorrect an exception is throwned in wich the web config credentials is shown on the screen.

Its not clear why the webbapp logs into the domain, but i need to

1. Make sure the credentials info is not shown in the exception.
2. Get the password from a database instead of storing it in web config.
3. Keep the impersonation function intact.

< system.web>

< identity impersonate=”true” userName=”Domain\AdminUser” password=”1234ABCD”>

< /system.web>

Answer 1

You could encrypt your web.config file and impersonate using web.config credentials in code to control the exception handling.