Correctly storing db connection strings in environment variables ASP.Net MVC Apps

Question

I am trying to move my 2 database connection strings to environment variables for security reasons. Everything works fine when I include the 2 connection strings on web.config like so:

<connectionStrings>
    <clear />
    <add name="DefaultConnection" connectionString="Data Source=xxxxxx" providerName="System.Data.SqlClient" />
    <add name="RDSContext" connectionString="Data Source=xxxxxx" providerName="System.Data.SqlClient" />
 </connectionStrings>

I then removed the 2 connection strings from web.config and created 2 environment variables as follows:

setx CUSTOMCONNSTR_DefaultConnection "Data Source=xxxxx" setx CUSTOMCONNSTR_RDSContext "Data Source=xxxxx"

Although I now get the following error when I startup IIS and visit the web app

Server Error in '/' Application. Cannot attach the file 'C:\Users\xxx\xxx\App_Data\BookingSystem.Models.RDSContext.mdf' as database 'BookingSystem.Models.RDSContext'.

Can anyone tell me what I am doing incorrect?

Answer 1

Simply naming your environment variable in a certain way doesn't mean that MVC will pick them up. You may be assuming a little more magic is happening than there actually is.

When you do ConfigurationManager.ConnectionStrings["MyConnectionStringName"].ConnectionString you're only retrieving the connection string from your web.config file, or machine.config if you happened to have defined it there. There's nothing there to tell your app to grab it from anywhere else.

Instead, you might consider creating a class to represent your configuration:

public class MyApplicationDatabaseConfiguration
{
    public string ConnectionString { get; set; }
}

Any class that needs to obtain this connection string can do so by depending on an instance of that MyApplicationDatabaseConfiguration.

public class MyDatabaseRepository
{
    readonly MyApplicationDatabaseConfiguration _dbConfig;

    public MyDatabaseRepository(MyApplicationDatabaseConfiguration dbConfig)
    {
        _dbConfig = dbConfig;
    }

    public void DoSomethingWithTheDatabase()
    {
         using(var connection = new SqlConnection(_dbConfig.Connectionstring))
         {
             //now you can use the connection
         }
    }
}

Then you can load your config however you like. Ex:

MyApplicationDatabaseConfiguration dbConfig = new MyApplicationDatabaseConfiguration();
dbConfig.ConnectionString = Environment.GetEnvironmentVariable("MyApplication_MyConnectionString");

Now the MyDatabaseRepository doesn't care how you load the database config, it simply says "I need the database config". This is extremely powerful, it allows you to change out the configuration by simply changing a line of code. Need to change back to using web.config? It's as simple as dbConfig.ConnectionString = ConfigurationManager.ConnectionStrings["MyConnectionStringName"].ConnectionString;

Microsoft has taken this one step further in Microsoft.Extensions.Configuration library, which is meant for .NET Core but targeted to .NET Standard, so you can use it in your .NET Framework library if you'd like .