Web Development

Ask something
Question Locked

asp.net connection string security

0 helpful
3 replies

by ajaxroshan

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i am new to web development in asp.net i want to know how can we secure the connection string. i have read some topics on net about encryption but i did not understand it properly bocz i have tried it on my pc it is not working. can any one will help me for securing my web site. And tell me how can hacker did not know about real connection string when we use encryption and decryption method and plz friends if u r having any demo then send to me ....
i use sql2005 and vs2005

3 replies

by tony hopkinson

Use integrated security
The account that IIS is using IUSER... (usually) needs to have it's login added to SQL 2005.
Then the connectionstring is just servername, database and then suffixed with ;Integrated Security = SSPI.

by contact4manoj

Use the web.config file.

Assuming that you are working on .NET 1.1, you would have to add the block, and under this you would declare a key-value pair to hold your connection string. Then, using the AppSettingsReader object, you can extract this value. (look at MSDN for an example).

But if you are working with .NET 2.0, then, you should declare your connection string under the section. This would be automatically read and made available by ASP.NET when your application runs.

In either case, this connection string is not embeded in the web.config file using any encryption. Remember, ASP.NET is configured to ensure that a request for this file will not be handled. Meaning, if any one places a request for the file Web.Config, ASP.NET will not deliver it. (This is of course assuming that you have ensured that IIS is configured to disable directory file listing).

Now. Regards to the User ID and Password in the connection string. First of all - if you are using SQL Server as the database, don't provide the User ID or Password. Instead opt for Windows Authentication. This is the best option. In such a case, you have two provisions. You can either add the web server's local ASPNET account to the DB Secured Logins and grant access to the DB. Or you can use the

This discussion is closed to new replies.