Securing a Connection String Within A Class Library

[Frinavale]

Hello everyone!

I'm having a problem securing my connection string.

There are a lot of sites out there that explain how to secure a connection string in the Web.config or App.config file; however, my connection string is being used within a Class Library (implemented with VB.NET), which doesn't have these files.

This class library is used by a web application to do all of my database manipulation so it is run under the ASPNET account. Because its run under this account the Integrated Security (Windows Authentication) option is not available to me.

I'm not really enthusiastic about trying to use impersonation to run my class library. I don't know if its even possible to do that it because its just a class library and not an application.

I have no idea how to secure my connection string.

Any suggestions are welcome because I am at a complete loss.

Thanks in Advance,

-Frinny

[kenobewan]

Here is an article that may help:
Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication or
How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI

[Frinavale]

Here is an article that may help:
Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication or
How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI

I had read all of those before.

I ended up removing the connection string from the Dll and putting it into the web application's web.config. Then I was able to properly encrypt it.

I was advised to try and keep the connection string out of the web application but I don't see any other way to do this without a lot of pain.

Thanks for the help!

-Frinny