Secure the connection string in ASP.NET

One of the best practices in ASP.NET is to save your database connection strings in the Web.config file instead of hard-coding it in your code. This allows you to change database servers easily, without needing to modify your code. As an additional protection, it is always better to use integrated Windows security to access your database, rather than using SQL Server authentication, and thus including your SQL server credentials in the connection string. Either way, it's not such a good idea to save your connection strings as plain text in Web.config -- you should ideally encrypt the connection strings so that it leaves no chance for a potential hacker to easily get more information about your database server.

In ASP.NET 2.0, Microsoft has taken this further by allowing you to encrypt the connection strings in Web.config.

Storing connection string in to the web.config without encryption

<configuration>

<appSettings>

<add key="ConnectionString"

value="server=localhost;uid=sa;pwd=;database=Northwind" />

</appSettings>

</configuration>

Encrypting and Decrypting the connection strings

Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people.

Decryption is theprocess of converting encrypted data back into its original form,so it can be understood.

Encrypting the connection string

private string EncryptString(string con)
{

Byte[] b = System.Text.ASCIIEncoding.ASCII.GetBytes(con);

string encrypted = Convert.ToBase64String(b);

return encrypted;
}

Description :

1) EncryptString() takes in the connectionString and returns the encrypted ConnectionString

2) Here we have used the ASCIIEncoding which gets the bytes representation of the connection string and store it in an array.

3) Finally, we encrypt the connection string using the ToBase64String method of the Convert class and the connection string is returned to the caller.

If you print out the connection string you will find something like this:

c2VydmVyPUFTVDI4Ni9TUUxFWFBSRVNTO2RhdGFiYXNlPVNjaG9vbDt1aWQ9c2E7cHdk PWFzc3lzdA==

Once you got the encrypted connection string you can copy and paste it in the web.config file.

<configuration>

<appSettings>

<add key="strconnect"

value="c2VydmVyPUFTVDI4Ni9TUUxFWFBSRVNTO2RhdGFiYXNlPVNjaG9vbDt1a WQ9c2E7cHdkPWFzc3lzdA==" />

</appSettings>

</configuration>

Decrypting the connection string

private string DecryptString()
{

Byte[] b = Convert.FromBase64String(ConfigurationSettings.AppSettings["strconnect"]);

string decrypted = System.Text.ASCIIEncoding.ASCII.GetString(b);

return decrypted;

}

Description:

1) First we get the byte representation of the connection string using the Configuaration Manager.Appsettings.
2) Then we decrypt the connection string using the same method that we first used to encrypt it. And finally we returned the decrypted connection string to the caller.

Here in this example i have accomplished Encryption and Decryption methods using the concepts of OOPS.So that you can be good in two concepts at the same time.

Lets build a class that supports these two methods.I have named the class as EnDe.cs.Its time to get in to the code.

EnDe.cs
------------

using System;
using System.Configuration;
using System.Collections.Generic;
using System.Text;

namespace BLL
{
public class EnDe
{
string _strCon;
string _connectionString;

public string ConnectionString
{
get { return _connectionString; }
set { _connectionString = value; }
}

public string StrCon
{
get { return _strCon; }
set { _strCon = value; }
}

/* Encryption method */

public string EncryptString()
{
Byte[] b = ASCIIEncoding.ASCII.GetBytes(StrCon);
string encrypted = Convert.ToBase64String(b);
return encrypted;
}

/* Decryption method */

public string DecryptString()
{
Byte[] b1 = Convert.FromBase64String(ConnectionString);
string decrypted = ASCIIEncoding.ASCII.GetString(b1);
return decrypted;
}
}
}

Add a WebForm named EnDe.aspx to our project.Add two buttons to the WebForm named "Encrypt the connection string" and "Decrypt the connection string" and name the id as btnEncrypt and btnDecrypt respectively.

Refer the class and create an object for the name.

EnDe ObjE = new EnDe();

Add the following code in btnEncrypt:

protected void btnEncrypt_Click(object sender, EventArgs e)
{

ObjE.StrCon = "server=localhost;database=School;uid=sa;pwd=admin";
string estring=ObjE.EncryptString();
Response.Write(estring); // You can see the encrypted connection string from here.Copy the connection string and paste it in the web.config file.
}

protected void btnDecrypt_Click(object sender, EventArgs e)
{
ObjE.ConnectionString = ConfigurationManager.AppSettings["strcon"];
string destring = ObjE.DecryptString();
Response.Write(destring); // You can see the decrypted connection string from here.
}