If you suffer from deep paranoia like me, you'll find a little disturbing to declare all your connection strings in the new
<connectionsStrings> section of your web application's Web.config file. This is how it looks like before encrypting:
<connectionStrings> <add name="Pubs" connectionString="Server=localhost;Integrated Security=True;Database=Pubs" providerName="System.Data.SqlClient" /> <add name="Northwind" connectionString="Server=localhost;Integrated Security=True;Database=Northwind" providerName="System.Data.SqlClient" /> </connectionStrings>
Behold ASP.NET 2.0 new security features. Now you can actually encrypt any section of your Web.config file on-the-fly and programatically. If you have full access to your Web server, you can encrypt your connection strings with this single command-line located in the in the %windows%\Microsoft.NET\Framework\versionNumber folder:
aspnet_regiis -pe "connectionStrings" -app "/SampleApplication"
If you can't execute commands in your web server, for example, when using shared hosting, you still can encrypt it programatically:
Configuration config = Configuration.GetWebConfiguration(Request.ApplicationPath);
ConfigurationSection section = config.Sections["connectionStrings"];
Now, the section in your Web.config file will look like this:
I hope you found this article useful. Happy coding!