Securing SQL Connection string in ASP.NET Core Windows authentication application

Question

Is there a way to secure the connection string or any user secret for ASP.NET Core application using Windows authentication?

Answer 1

In general, if you're using Windows Authentication, the connection string shouldn't need to contain sensitive data - if it does, you likely have a mistake in it. Your connection string should contain the absolute minimum amount of information required to connect to your database (eg server name, authentication type) - no more.

By definition, if you're using Always Encrypted, you don't need to include any user secret in your connection string in order to log on - so don't include it.

Any other user secrets not related to connecting to the database can be stored via another mechanism, such as SQL Server's Always Encrypted mechanism .