Saving to SQL Server database from WPF

Question

I have a SQL Server database hosted on Azure. I need to write data from multiple PC users that are using WPF app to this database.

Assuming that WPF app is used by multiple users is it safe to save connection string in app.config file? What are the best practices for saving data from a Windows app into a shared database?

I'm afraid that users can manipulate data by utilizing connection string stored in app.config .

Answer 1

Assuming that WPF app is used by multiple users is it safe to save connection string in app.config file?

IMHO, it is never safe to store connection string in plain text. You're absolutely correct that users can connect to the database outside of your application and cause some serious damage to your database.

A few things that come to my mind are:

• Encrypt the connection string and use that instead of storing connection string unencrypted.
• Use Azure AD based access control . Recently Azure team announced availability of connecting to a SQL Database using Azure AD credentials. This way you can authenticate the users before they connect to your database. You can read more about it here: https://azure.microsoft.com/en-in/documentation/articles/sql-database-aad-authentication/ .

You may also find the following article useful in securing your Azure SQL Database: https://azure.microsoft.com/en-us/documentation/articles/sql-database-security-guidelines/ .