How to hide XML Configuration File

Question

I have just finished making my application and finished building it. And everything is working fine.

And then I notice an XML Configuration file in the folder, So I click it.

And there it is, my whole connectionstrings along with my remote sql server ip address, login username and login password which is visible for all to see.

I tried deleting the XML Configuration file and ran the program, it just makes a App_Data folder inside the folder with a default database.

Is there any way to hide the XML Configuration file or make it unreadable, as it contains all my connection info.

Thanks.

Answer 1

Check out this MS article regarding securing your connection strings:

https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/protecting-connection-information

Alternatively, hard-code the connection string into your application (note: malicious users can reverse engineer .net apps fairly easily), or use Integrated Security if possible.

Answer 2

You can either encrypt it: http://chiragrdarji.wordpress.com/2008/08/11/how-to-encrypt-connection-string-in-webconfig/

or use Integrated Security if you can.

Answer 3

Any attempts to hide the connection string will just make it slightly more difficult to access for both you and any attackers. It is not unusual but not very secure and there is also the problem with ensuring regular password rotation.

If you can, switch to integrated security. (Include Integrated Security=SSPI in the connection string, but no user name or password.) The connection will be created using your own user account (or the account running your code), assuming that

• You are using MS SQL Server
• The SQL Server is on the same system, or in the same AD domain and will be thus able to recognize the account.

Answer 4

A dedicated debugger will be able to see your connection string pretty much no matter what you do.

Remember if you can look at Connection.ConnectionString in a debug session so can a user with WinDBG or Visual Studio. So even if you encrypt the file the user can just let you decrypt and then inspect the clear text value.

This is why many client applications (especially mobile ones) that need information from a server typically don't directly connect to a database. Instead they typically connect to a service instead. Then you authorize and authenticate the user against your service.