ASP.NET连接字符串加密/保护

Question

在ASP.NET中保护/加密连接字符串的最佳做法是什么，而不仅仅是在Web.Config中以纯文本形式存储

Answer 1

看看在.NET中以编程方式加密配置文件 ，它似乎涵盖了这一点。

Answer 2

You can set this section to be encrypted .

However, that default encryption has pitfalls pointed out by others. You can also set your connection strings section to point to an external file, and that external file will work in concert with encryption. That should solve most concerns, because the sysadmin can set up encryption there without breaking anything else in the developer's web.config and a devloper can deploy changes to the config without undoing the sysadmin's encryption.

Answer 3

Web.Config has built in support for encrypting connection strings (and other data), but this does have some overhead because the encryption is tied to the server, so the encryption must be set up by a server admin and not the developer.

you could also encrypt manually, with the encryption routine in your source.

Why are you encrypting? Who are you protecting from? Hackers getting access to the web config? Developers that shouldnt know the prod connection string? The reasons behind the encryption will change the solution somewhat.

Answer 4

Best Practice is to use Windows Authentication (with the caveat on connection pooling).

Failing that, encrypting connection strings is good practice: Keeping secrets in ASP.NET 2.0.

Note: basic approach does not work with web farms.