How to hide XML Configuration File

Question

I have just finished making my application and finished building it. And everything is working fine.

And then I notice an XML Configuration file in the folder, So I click it.

And there it is, my whole connectionstrings along with my remote sql server ip address, login username and login password which is visible for all to see.

I tried deleting the XML Configuration file and ran the program, it just makes a App_Data folder inside the folder with a default database.

Is there any way to hide the XML Configuration file or make it unreadable, as it contains all my connection info.

Thanks.

Answer 1

Check out this MS article regarding securing your connection strings:

https://learn.microsoft.com/en-us/dotnet/framework/data/adonet/protecting-connection-information

Alternatively, hard-code the connection string into your application (note: malicious users can reverse engineer .net apps fairly easily), or use Integrated Security if possible.

Answer 2

You can either encrypt it: http://chiragrdarji.wordpress.com/2008/08/11/how-to-encrypt-connection-string-in-webconfig/

or use Integrated Security if you can.