Encrypted Database Connection Strings

Question

I'm using the Oracle.ManagedDataAccess.Client to connect to a oracle database (v.12) in my C# Windows Application.

As example:

using Oracle.ManagedDataAccess.Client;

string connStr = "user id=username;password=secret;data source=(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=hostname)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=servicename)))";
new OracleConnection(connStr);

as you can see the is in plain text. Can you suggest how this should be done, preventing passwords in code?

Im using .Net Framework 4.5.1 (Windows Application)

Thank you in advance

Answer 1

The best way to prevent storing database credentials in the code of client app is to get data from the database via some API after authenticating the user in the application (using OpenId Connect or other protocol).

In this case, the API is responsible for communication with the database - not the client, so there is no need to store credentials on the client.

It is a bit different approach than you asked for, but I think it is the best solution.