ASP.NET Web.Config referencing config file outside web root

Question

I'm having a dispute over a web config layout from a security point of view.

Our app.config is including a key which references two files containing the security settings (db name, password, AD root, a valid user and password to authenticate against, etc). Those two files are outside the web root, and plain text. Somehow i feel that's plainly wrong. That's what web.config is for, to hold configs, and since it can be encrypted, and IIS would never serve a .config file, it should be safe enough.

Is it really a bad practice? Can anyone point me in the right direction? thanks in advance.

Answer 1

Best practice is to keep any security settings in web.config file and access them in your code behind. Besides you can encrypt and transform your config security settings in web.config as well.