SQL Server administration and T-SQL development, Web Programming with ASP.NET, HTML5 and Javascript, Windows Phone 8 app development, SAP Smartforms and ABAP Programming, Windows 7, Visual Studio and MS Office software

Kodyaz Development Resources

Development resources, articles, tutorials, samples, codes and tools for .Net, SQL Server, Windows, Windows Phone, SAP and ABAP, like SAP UI5, Screen Personas, etc.






.NET Framework, ASP.NET

ASP.NET, Windows Forms, Controls, .NET Framework and Visual Studio Articles

ASP.NET Forums

Visual Studio Forums

.NET Development Blog

Certification Exams Blog




Encrypting sensitive information stored in the web.config file


It is now possible to encrypt sections in a web.config configuration file by using DataProtectionConfigurationProvider and the ProtectSection method of the SectionInformation class.
First of all we should open the Microsoft Visual Studio IDE with the Administrative priviledges if we are developing on a Microsoft Windows Vista machine. Other wise we can face some problems regarding to the security issues. So open the VS IDE by Run as Administrator command shown below:





Run as Administrator

Then create a new web site.

New web site

 

Web site templates

 

location

Let's add to Default.aspx web page some information from a database.

Open the Server Explorer window. You can use the Ctrl+Alt+S shortcut key combination in order to display the Server Explorer. Or open the View menu item then select the Server Explorer.

Server Explorer

Here for my sample application, I have already a data connection to my local SQL Server 2005 instance AdventureWorks sample database. Let's create an other data connection in order to see how we can connect to a SQL Server instance and database.

Add Connection

In order to connect to a Microsoft SQL Server instance select the data source of your connection as shown below:

SQL Data Source

I'm adding a snapshot of the database Adventureworks which I've created for reporting purposes. You can review the article How to Create a Database Snapshot for how AdventureWorks_SS snapshot database can be created.

SQL Client Connection

I connect to the snapshot database with SQL Server Authentication which requires a user name and a password. We will keep the database connection user name and password in the web.config configuration file and we will encrypt and decrypt the connection string section of the configuration file for security considerations.

If the connection test is successfull you will see that AdventureWorks_SS is also listed in the Data Connections in the Server Explorer. If so, drill down the Tables and drag and drop one of the tables on the web form.

Let's drag and drop the HumanResources.Department table on the web page, Default.aspx

datagrid

As you see a datagrid and a SqlDataSource object is created on the web form automatically.

Also if you open the web.config file you can see that connectionStrings section has now a new item named AdventureWorks_SSConnectionString1 which keeps the connection string with the user name / user id and the password for the data source.

<connectionStrings>

<add name="AdventureWorks_SSConnectionString1" connectionString="Data Source=KODYAZ;Initial Catalog=AdventureWorks_SS;Persist Security Info=True;User ID=adventure;Password=works" providerName="System.Data.SqlClient" />

</connectionStrings>

This actually is not a secure way of keeping sensitive data in web.config configuration file.

Before we continue to encrypt the connection string, we should edit the SqlDataSource command strings since the commands unfortunately include the schema names in front of the table name Department.

For instance SelectCommand is as follows

SELECT [DepartmentID], [Name], [GroupName], [ModifiedDate] FROM [Department]

But must be modified as

SELECT [DepartmentID], [Name], [GroupName], [ModifiedDate] FROM [HumanResources].[Department]

The other commands, DeleteCommand, InsertCommand and UpdateCommand as well as the SelectCommand should be updated in the same manner.

After the update in the SqlDataSource you can browse the default.aspx page and display the list of departments on the web page.

Now add a new item to the web site using the Solution Explorer window. Right click on the web site and on the context menu select Add New Item... then the Visual Studio installed templates will be displayed. Select the Global Application Class with the default name Global.asax and add this new item.

Open the Global.asax global application class file and paste the following lines of code in order to encrypt the database connection string information.

Protected Sub EncryptConfig()

Dim path = "/WebSite1/"

Dim config As Configuration = System.Web.Configuration.WebConfigurationManager.OpenWebConfiguration(path)

Dim appSettings As ConfigurationSection = config.GetSection("connectionStrings")

appSettings.SectionInformation.ProtectSection("DataProtectionConfigurationProvider")

config.Save()

End Sub

Call this function from the Application_Start sub procedure in the global application class file. After you start and browse the default.aspx page, if you open the web.config file you will see that the connectionStrings section in the configuration file is encrypted as follows.

<connectionStrings configProtectionProvider ="DataProtectionConfigurationProvider">

<EncryptedData>

<CipherData>

<CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBA........mIot4KGnA1xEz4jqObhKco=</CipherValue>

</CipherData>

</EncryptedData>

</connectionStrings>

You can decrypt the configuration section back to its original status using the

appSettings.SectionInformation.UnprotectSection()

instead of

appSettings.SectionInformation.ProtectSection("DataProtectionConfigurationProvider")

to encrypt the section.

You can download a sample web site application from the files section of this site by following Encrypting Sensitive Information in Web.Config link.












Copyright © 2004 - 2017 Eralper YILMAZ. All rights reserved.
Community Server by Telligent Systems