ASP.NET Core appSettings.json安全

Question

I have an ASP.NET Core 2.0 WebAPI application that has Db ConnectionString in appSettings.json. While in development it has this value:

"DefaultConnection":"Server=localhost;Database=Tyroll;Trusted_Connection=True;MultipleActiveResultSets=true"

and only when we publish it to production we change this with appropriate passwords, by using VS 2017 publish profile.

So SQL server passwords for are not stored on repository and no problem there.

The file appsettings.json is protected by IIS
The question I wonder is should this password be somehow 'hidden' even on IIS?
One reason being additional security, so that SQL credentials are not in plain text in case of breach here. Another for some authorization scenario where IIS admin should not have directly access to SQL server.

I figure it could be encrypted and the app itself will have key for decrypting it. This would not be 100% secure since in the case of breach on IIS even this key could be reverse engineered from the app, but it would make it more difficult then when it's there in plain text.

So first question is should I be doing this at all?

And second if 1.Q is Yes, what would be the best / recommended way to do it?

Is there some built in tool for this in .NetCore2 or VS2017 or IIS, or some other tool?

Here are some related links:

• reddit aspnet_core_appsettingsjson_security_question
• stackoverflow is-appsettings-json-protected-by-iis
• itprotoday passwords-webconfig
• keeping-secrets-in-asp-net-core

Answer 1

I would suggest that you should user Active Directory Integrated security for accessing the database , the App Pool can run under the user account and that particular user account will only have the required access to the database . This safeguards the user credentials in case of an attack since the password is never exposed.

Answer 2

Solution I implemented is making custom encryption of Password in ConnectionString .
But since the App needs to the decrypt it, it is more an Obfuscation.
For encryption I have used AES (using System.Security.Cryptography) and the key is stored: half in connectionString itself and other half hardCoded in the Application.
In addition regex was used to extract Password from ConnectionString and then was replaced with decrypted string of it.