By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
459,292 Members | 1,467 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 459,292 IT Pros & Developers. It's quick & easy.

Web.config

P: n/a
Should the web.config file be included in my deployment, IE physically
located in the web app's virtual directory on a release? It makes me
nervous having my DB conn string, etc in a ASCII file so available. I am
hoping the answer is "it gets compiled, and is placed in the
\bin\myproject.dll file"

Chris
Nov 17 '05 #1
Share this Question
Share on Google+
3 Replies


P: n/a

The web.config file is human readable, and not encoded - meaning, yes, if
you are concerned with security, you should encrypt (or store elsewhere)
sensitive data like connection strings. The web.config file is a means of
altering the state of an application while it's running, without shutting
down services.

One solution is to encrypt the connection string (or any sensitive data)
using the available crypto classes in the security assembly. Then you can
decrypt the connection string when it's needed by the application. I'll
paste some sample code for this below.
Charlie Nilsson [msft]
Visual Studio Update
'################################################# #################
' Sample encryption code in VB
'################################################# #################
Imports System
Imports System.IO
Imports System.Security.Cryptography
Imports System.Text

Public Class MyCryptoClass

'private key - enter random numbers here
Private Shared key() As Byte = {12, 52, 53, 124, 33, 36, 77, 48, 29, 50,
111, 112, 213, 14, 135, 116, 167, 198, 109, 200, 211, 29, 33, 35}
'init vector
Private Shared iv() As Byte = {12, 125, 37, 140, 65, 56, 76, 18, 99, 107,
122, 123, 153, 114, 159, 196, 179, 198, 192, 220, 212, 123, 33, 54}

'################################################# #################
' Encrypt
' - Encrypts a plaintext string
'################################################# #################
Public Shared Function Encrypt(ByVal plainText As String) As String
Dim cryptoProvider As TripleDESCryptoServiceProvider = New
TripleDESCryptoServiceProvider
Dim ms As MemoryStream = New MemoryStream
Dim cs As CryptoStream = New CryptoStream(ms,
cryptoProvider.CreateEncryptor(key, iv), CryptoStreamMode.Write)
Dim sw As StreamWriter = New StreamWriter(cs)
sw.Write(plainText)
sw.Flush()
cs.FlushFinalBlock()
ms.Flush()
'convert back to a string
Return Convert.ToBase64String(ms.GetBuffer(), 0, ms.Length)
End Function

'################################################# #################
' Decrypt
' - Decrypts a plaintext string
'################################################# #################
Public Shared Function Decrypt(ByVal encodedText As String) As String
Dim cryptoProvider As TripleDESCryptoServiceProvider = New
TripleDESCryptoServiceProvider
'convert from string to byte array
Dim buffer As Byte() = Convert.FromBase64String(encodedText)
Dim ms As MemoryStream = New MemoryStream(buffer)
Dim cs As CryptoStream = New CryptoStream(ms,
cryptoProvider.CreateDecryptor(key, iv), CryptoStreamMode.Read)
Dim sr As StreamReader = New StreamReader(cs)
Return sr.ReadToEnd()
End Function

End Class








--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm






Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------
Reply-To: "Chris Fink" <ch***@chrisfink.com>
From: "Chris Fink" <ch***@chrisfink.com>
Subject: Web.config
Date: Fri, 11 Jul 2003 11:55:43 -0400
Lines: 9
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <#w**************@TK2MSFTNGP10.phx.gbl>
Newsgroups: microsoft.public.dotnet.framework.aspnet
NNTP-Posting-Host: 130.decisionone.com 192.204.130.200
Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTN GP10.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.framework.aspnet:158568
X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet

Should the web.config file be included in my deployment, IE physically
located in the web app's virtual directory on a release? It makes me
nervous having my DB conn string, etc in a ASCII file so available. I am
hoping the answer is "it gets compiled, and is placed in the
\bin\myproject.dll file"

Chris


Nov 17 '05 #2

P: n/a
Or you can use a tool like this one (or roll out your own as Charlie
suggested): http://www.obviex.com/cipherlite/. However, be aware of the risk
of embedding the key in your application source code.

Alek

"Charlie Nilsson [MSFT]" <Ch********************@hotmail.com> wrote in
message news:Sy**************@cpmsftngxa06.phx.gbl...

The web.config file is human readable, and not encoded - meaning, yes, if
you are concerned with security, you should encrypt (or store elsewhere)
sensitive data like connection strings. The web.config file is a means of
altering the state of an application while it's running, without shutting
down services.

One solution is to encrypt the connection string (or any sensitive data)
using the available crypto classes in the security assembly. Then you can
decrypt the connection string when it's needed by the application. I'll
paste some sample code for this below.
Charlie Nilsson [msft]
Visual Studio Update
'################################################# #################
' Sample encryption code in VB
'################################################# #################
Imports System
Imports System.IO
Imports System.Security.Cryptography
Imports System.Text

Public Class MyCryptoClass

'private key - enter random numbers here
Private Shared key() As Byte = {12, 52, 53, 124, 33, 36, 77, 48, 29, 50,
111, 112, 213, 14, 135, 116, 167, 198, 109, 200, 211, 29, 33, 35}
'init vector
Private Shared iv() As Byte = {12, 125, 37, 140, 65, 56, 76, 18, 99, 107,
122, 123, 153, 114, 159, 196, 179, 198, 192, 220, 212, 123, 33, 54}

'################################################# #################
' Encrypt
' - Encrypts a plaintext string
'################################################# #################
Public Shared Function Encrypt(ByVal plainText As String) As String
Dim cryptoProvider As TripleDESCryptoServiceProvider = New
TripleDESCryptoServiceProvider
Dim ms As MemoryStream = New MemoryStream
Dim cs As CryptoStream = New CryptoStream(ms,
cryptoProvider.CreateEncryptor(key, iv), CryptoStreamMode.Write)
Dim sw As StreamWriter = New StreamWriter(cs)
sw.Write(plainText)
sw.Flush()
cs.FlushFinalBlock()
ms.Flush()
'convert back to a string
Return Convert.ToBase64String(ms.GetBuffer(), 0, ms.Length)
End Function

'################################################# #################
' Decrypt
' - Decrypts a plaintext string
'################################################# #################
Public Shared Function Decrypt(ByVal encodedText As String) As String
Dim cryptoProvider As TripleDESCryptoServiceProvider = New
TripleDESCryptoServiceProvider
'convert from string to byte array
Dim buffer As Byte() = Convert.FromBase64String(encodedText)
Dim ms As MemoryStream = New MemoryStream(buffer)
Dim cs As CryptoStream = New CryptoStream(ms,
cryptoProvider.CreateDecryptor(key, iv), CryptoStreamMode.Read)
Dim sr As StreamReader = New StreamReader(cs)
Return sr.ReadToEnd()
End Function

End Class








--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm






Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------
Reply-To: "Chris Fink" <ch***@chrisfink.com>
From: "Chris Fink" <ch***@chrisfink.com>
Subject: Web.config
Date: Fri, 11 Jul 2003 11:55:43 -0400
Lines: 9
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <#w**************@TK2MSFTNGP10.phx.gbl>
Newsgroups: microsoft.public.dotnet.framework.aspnet
NNTP-Posting-Host: 130.decisionone.com 192.204.130.200
Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTN GP10.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.framework.aspnet:158568 X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet

Should the web.config file be included in my deployment, IE physically
located in the web app's virtual directory on a release? It makes me
nervous having my DB conn string, etc in a ASCII file so available. I am
hoping the answer is "it gets compiled, and is placed in the
\bin\myproject.dll file"

Chris

Nov 17 '05 #3

P: n/a
It must be included, in it's raw form.

However, IIS won't allow browsing the file- it's specifically DISALLOWED -
so no exposure there.
As far as local access, set Windows security for only the internal IIS user,
developers group etc to have access, and you should be OK.

"Chris Fink" <ch***@chrisfink.com> wrote in message
news:#w**************@TK2MSFTNGP10.phx.gbl...
Should the web.config file be included in my deployment, IE physically
located in the web app's virtual directory on a release? It makes me
nervous having my DB conn string, etc in a ASCII file so available. I am
hoping the answer is "it gets compiled, and is placed in the
\bin\myproject.dll file"

Chris

Nov 17 '05 #4

This discussion thread is closed

Replies have been disabled for this discussion.