Asp.NET中持久性安全信息的合适选项

Question

From the starting of asp.net projects, I am using below connectionstring

Data Source=Server; Initial Catalog=Database; User Id=sa; Password=123456; Persist Security=true;

Many times, I feel confuse by using Persist Security . I read that if I set it to true, windows will remember password and if I set it to false then It won't return credentials.

What is the best suitable option to use Persist Security , specially for e-commerce type website ? Is there any another best way to define User Id and Password ?

Answer 1

Typically, if you have a user id and password, you don't need Persist Security .

What's a good way to define these credentials? If you're in a cloud hosting scenario like Azure, don't define these in the web.config, but rather define the connection string in the Azure portal. This keeps the production credentials out of version control, and may also protect enterprise credentials from developers.

If you're in a more traditional hosting environment, and your database and website are on the same virtual machine, you may be able to use a trusted connection (windows login account), avoiding the credentials in the web.config all together.

Look to connectionstrings.com for building connection strings to SQL Server (and other databases) in various forms.