C# .NET remote DB connection

Question

So I have this Team Services shared project which I've pulled locally. I am connecting to a remote DB which requires credentials in order to do anything with it. Everything works fine, and my connectionString is as follows:

<add name="PluginSchedulerContext"
   connectionString="metadata=res://*/PluginSchedulerDataModel.csdl|res://*/PluginSchedulerDataModel.ssdl|res://*/PluginSchedulerDataModel.msl;provider=System.Data.SqlClient;

     provider connection string=&quot;
     data source=xxx.xxx.xxx.xxx;
     initial catalog=TestDB;
     persist security info=True;
     user id=xxx;
     password=xxx;
     MultipleActiveResultSets=True;
     App=EntityFramework&quot;"

   providerName="System.Data.EntityClient" />

I was wondering if there is a smarter way to do this and to omit the password field in the string since app.config as I see is not part of the .gitignore . (I am migrating from Laravel PHP)

Answer 1

The better way is that, you can change connectionstring to connect to another database (test database), then you can replace connectionstring through Replace Token task to connect to actual database when you deploy app to the server through build or release .

If you just want to use an database, can specify connectionstring programmatically. (Encrypt password, then store the encrypted password to your app, then decrypt password and combine connectionstring with actual password and specify it to entity context. The decrypt local could be in additional assembly.)

var encryptedPassword="xxx";
var actualPassword=[decrypt password];
var connstring = [combine connectionstring with actual password];
var estringnew = new EntityConnectionStringBuilder(connstring);
estringnew.Metadata = XXX
var context = new BAEntities(estringnew.ToString());
var query =
    from con in context.Contacts
    where con.Addresses.Any((a) => a.City == "Seattle")
    select con;

More information, you can refer to this article. For this way, developers can debug application to know actual password.

If you don't want to let developers to know the actual password, you can encrypt connectionstring

Answer 2

If you use Windows Authentication (client and database access using same Windows login) you don't need the username and password in your source code.

Or you'll need to edit the configuration when you deploy.

Otherwise the credentials are in your project's configuration in your VCS.

Answer 3

Try to use the Entity Framework. It's much easier! https://www.asp.net/entity-framework