保护 web.config 设置

Question

We are developing an ASP.NET MVC 5 application. We hired some remote developers to help us with the project.

The web.config file contains connection strings and app settings that we don't want to share with these remote developers. To work on our application, these developers remote into a development desktop that we control.

What is the best practice for securing sensitive information in web.config, so that developers can still run and debug application but not read the sensitive info in web.config?

Answer 1

Encrypting the web.config in a development environment is pointless. The only way to truely hide the information from the developers is not to give it to them in the first place.

1. You must ensure that your "remote development environment" is setup only to access a development database and is configured with other development settings only.
2. Don't check in any sensitive data (production passwords, etc) into your source control. You can achieve this by separating the information into external .config files so they are not checked into source control. TIP: Ignore the file with the actual passwords and add another one with the same name and an extension such as .config.example that is checked in to give the developer instructions on how to setup the file on their local system (which is a helpful reminder regardless of who sets up the system from a clone of the source control repository).
3. Use a continuous integration server ( TeamCity , Jenkins , Octopus Deploy , etc) to build sensitive information into the release workflow through environment variables . Many CI servers have the ability to hide sensitive data from the UI . You can either practice automatic deployment via CI button-click so your developers don't have access to the sensitive data that is in the CI server, or give the deployment artifact(s) to a trusted team to install in production.

There is really no reason why a developer should even be given a chance to see sensitive production data such as passwords and private keys.

Answer 2

Like Ingenioushax suggested, the standard way of encrypting sections of web.config is using aspnet_regiis. Here is a tutorial .

Answer 3

How are you deploying your application?

If you use a tool such as Octopus Deploy - that only your onshore team have access to - you can use that to store any sensitive settings. These will get inserted into your configuration file during deployment.

In Octopus Deploy these are known as configuration variables .

This assumes that the sensitive settings are for environments other than ones that the developers will use themselves (Production and UAT, for example).

Answer 4

您可以将配置变量存储在环境变量中，并在运行时将它们读入应用程序 - 这更好，因为每个开发人员和环境都可以拥有自己的配置，这些配置永远不会与其他人发生冲突。