How to protect web.config file?

Question

User546194788 posted

After published apps, I found that web.config which stored connection string including SQL server password not compile.

How to make web.config not text file but apps can still read it?

Answer 1

User2103319870 posted

How to make web.config not text file but apps can still read it?

You can take a look the option of Encrypting AppSettings and ConnectionString in webconfig file. 

https://msdn.microsoft.com/en-us/library/dtkwfdky.aspx

Answer 2

User61956409 posted

Hi aspfun,

After published apps, I found that web.config which stored connection string including SQL server password not compile.

If you host your web application on IIS server, you need not worry browser clients access web.config file and get the SQL server password, because by default IIS help block several of the ASP.NET-related paths for us; Web.config, bin, App_Code, etc.

Besides, if you want to prevent someone who could connect to your web server from getting plain-text password, as A2H mentioned, you can encrypt Connection Strings in Web.Config.

• Encrypt and Decrypt Connection Strings in Web.Config file in ASP.Net

With Regards,

Fei Han

Answer 3

User-1320437544 posted

Encrypt the sensitive areas of the web.config as the two guys before me already said. That's the best you could do. The version of the framework which you are using has tools for doing it.