Encrypting connection strings and click-once publishing

Protecting application secrets, such as database connection strings and passwords, requires careful consideration of a number of pertinent factors such as how sensitive the data is, who could gain access to it, how to balance security, performance, and maintainability, and so forth. This article explains the fundamentals of data protection and compares a variety of techniques that can be used to protect application settings. The author discusses what to avoid, such as hiding keys in source code and the use of Local Security Authority. In addition, he presents some effective solutions such as the Data Protection API.

Alek Davis

MSDN Magazine November 2003

Hello all,

Thanks in advace for your help.

I have a C# web service where I need to access a MS SQL DB. I see a way of creating a connection string in IIS and using it in the web application when connecting to the DB. In IIS in Connection strings you specify the name of the connection, server, user n pwd

How can I use the name of connection string created in IIS in my c# app.?

I am currently using

CustomerInfo customerinfo = new CustomerInfo<

 Is aspnet_regiis.exe secure? If i encrypt using aspnet_regiis.exe, will it automatically decrypt the string and wont give any error? Need an insight into this stuff....any suggestions? Is Rsa the best option or wat? Wat's the best way to encrypt/decrypt programmatically?

Folks,

I have an ASP.NET project which is pretty n-tier, by namespace, but I need to separate into three projects:  Data Layer, Middle Tier and Front End.

I am doing this because... 

A) It seems the right thing to do, and

B) I am having all sorts of problems running unit tests for ASP.NET hosted assemblies.

Anyway, my question is, where do you keep your config info?

Right now, for example, my middle tier classes (which uses Linq to SQL) automatically pull their connection string information from the web.config when instantiating a new data context.

If my data layer is in another project can/should it be using the web.config for configuration info?

If so, how will a unit test, (typically in a separate assembly) provide soch configuration info?

Thank you for your time!

I am using the configuration file to read the connection string in the SSIS packages. In one of my packages i have to use two different connection strings. If i specify the second connection string in the config file, then the current package works well but other packages fails during validation saying the second connection manager does not exist in the package. Is it not possible to have multiple connection string in a single config file?

Hi!

I am using a datasource in the report server where all the reports use that shared datasource while calling the reports from asp.net pages.

Now, as asp.net pages uses the connection string for the databases which is assigned in the web.config file, i want the reports also use the same connection string because you don't need to change on both places( web.config and report server datasource).

Any idea plz

Hi, I am using both Azure & WinForms applications, with common libraries in .NET 4. I have encrypted my connection strings in my Azure app using the approach here: http://blogs.msdn.com/b/sqlazure/archive/2010/09/07/10058942.aspx  That is working fine, no issue with the Azure side (this is not an Azure question).

I have now encrypted the connection strings in my app.config file of my windows app, and have imported the .pfx certificate into my certificate store. When I run my app after just importing the certificate, it works fine. It decrypts the connection strings and works. After I reboot however, it fails because it does not have access to the private key in the .pfx file. I assume that's because the private key needs to be authenticated again.

I am a newbie to encryption, and although I've spent the past few days finding what I can, but I can't crack the right way to work with this.

How can I embed the private key in the .pfx file, so when I run the app on my development machine, it will have access to the private key & work?

Thanks, +M

Hi,

We have website hosted on shared server with SQL Server 2005 as database. Now that database server is also shared by other people and hence we have to use SQL Server authentication and we have stored those connection strings in our web.config file.

Can we encrypt connection strings? I found few ways to encrypt but in all of them I have to have access to the server and that I don't have.

Pls help.

Anand

Hi,

I want to add multiple rows of a gridview if the data for multiple fields are same.

Idea for this is that a user may search a record with some parameter e.g. Sector, plot.

For example 15 records being displayed in gridview.

There should be checkbox before every row and if user wants to update Plot and Flat No that is same for 10 rows out of 15 so he will check the rows and update.

For this a dialog box should appear asking for the parameter i.e. Plot and Flat or something else next time may be it will be City or country. Moreover, there is already an Edit button to update records, when user click it another page open for the record to be updated and whatever he wants to update, it updates.

Hope everone understand the scenario.

I don't want to disturb the already provided Edit functionality and want to provide same record to be updated.

Any idea in this regard would be appreciated.

looking for confirmation that using jquery to click an <a> element does not simulate the click of the link like it does in the object returned by getElementById.

<a id="anchor1" href="http://www.google.com">google</a>

// this does not click the link.
var x2 = $('#anchor1');
x2.click();

// this does click the link.
var x3 = document.getElementById('anchor1') ;
x3.click( ) ;

// this syntax returns the DOM object for the anchor element which can be clicked to redirect to the link.
var x4 = $('#anchor1') ;
var x5 = x4[0] ;
x5.click( ) ;

What is the proper way to check for null or empty strings on dynamic objects? This is the only solution I've found so far:

if (admin.PasswordHash.GetType() == typeof(DBNull) || admin.PasswordHash == string.Empty)

If the field is null, the object returned is DBNull.Value, but if the field is empty string, it's return as a System.String object. This makes it impossible to do regular "admin.PasswordHash == DBNull.Value" check, as that will fail whenever the field has been set to empty string. Is my example the right (and only) way to go?

when publishing  in the webmatrix dialogue it asks for "destination connection string" for my "database.mdf"

I was not sure what it was so I pasted this from my web.config file :

Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\database.mdf;Integrated Security=True;User Instance=True