ASP.NET Connection String Encryption / Protection

Question

What is best practice for protection/encryption of connection strings in ASP.NET rather than just storing as plain text in Web.Config

Answer 1

Take a look at Programmatically encrypting a config-file in .NET, it seems to cover this ground.

Answer 2

You can set this section to be encrypted.

However, that default encryption has pitfalls pointed out by others. You can also set your connection strings section to point to an external file, and that external file will work in concert with encryption. That should solve most concerns, because the sysadmin can set up encryption there without breaking anything else in the developer's web.config and a devloper can deploy changes to the config without undoing the sysadmin's encryption.

Answer 3

Web.Config has built in support for encrypting connection strings (and other data), but this does have some overhead because the encryption is tied to the server, so the encryption must be set up by a server admin and not the developer.

you could also encrypt manually, with the encryption routine in your source.

Why are you encrypting? Who are you protecting from? Hackers getting access to the web config? Developers that shouldnt know the prod connection string? The reasons behind the encryption will change the solution somewhat.