The idea of storing connection strings in a data base is a perverse idea, but please hear me out first. We all know that it’s best practice to encrypt connection strings in the web.config file, but what if we just skip the web.config file completely?
A couple of months ago I was asked to move databases from one server to another. This meant having to update connection strings in every program that accessed these various databases. This is the 3rd time in 2 years I’ve had to move databases from one server to another. So I thought of storing connection strings in a database and assigning each a GUID to be accessed via a web service. Instead of placing connection strings in a web.config, you would just need to store the connection string GUID in the web.config, and reference the connection string web service so that you could request that connection string. Encryption can be done at the application level and connection strings are just stored encrypted in the database.
I’ve created a proof of concept and it works fine (its just on a local intranet and not exposed to the internet).
The benefit is obvious to me; such as being able to quickly update connection strings without having to touch the web application. This means that you could build a web application just for editing connection string in the database, that a DBA could use on there own, so they never have to bother a programmer when moving databases.
But the benefit is not what I’m interested in. I’m interested in what everyone here thinks about doing something like this?
Take your connection strings out of the main web.config and put them in a separate config file. This file will then be the same for all your apps so if they have to change you just have to copy and paste the same file into all your app folders instead of edit each config separately.