Answer / kinjal panchal

<configuration>
<appsetting>
<add key="debug" value="true"/>
<add key="server" value="your server name"/>
<add key="Database" value="your databse name"/>
<add key="username" value="your username"/>
<add key="password" value="your password"/>
</appsetting>

<connectionstring>
<add name="cnnectionstrigname"
connectionstring="datasource=server name; initial
catalog=database name; user id=your username; password=your
password" providername="system.data.sqlclient"/>
</connectionstring>
</configuration>

Answer / ananth

Taking a clue, Microsoft has provided the capability to
encrypt sensitive information in configuration files
including connection strings in ASP.NET 2.0. With this new
capability you can easily encrypt sections of configuration
files which makes your application secure.

This new capability brings it with performance overhead that
occurs when you encrypt or decrypt sections of web.config
files. So use it sparingly. That means be judgmental and
judicious when you decide to encrypt data.

ASP.NET 2.0 introduced Protected Configuration model that
allows you to encrypt data using two Protected Configuration
Providers. They are:

*

RSAProtectedConfigurationProvider: This is the default
provider and uses the RSA Public Key Encryption algorithm to
encrypt and decrypt data.
*

DataProtectionConfigurationProvider: This provider
uses Windows Data Protection Application Programming
Interface (DPAPI) to encrypt and decrypt data.

Let's explore this new capability of encrypting and
decrypting of connection strings in web.config files using
above two providers available in ASP.NET 2.0.
Programmatic Encryption/Decryption

Take web.config file which contains valid connection string
from some existing project. Bellow is an example of
configuration section.

<configuration>
<appSettings/>
<connectionStrings>
<add name="NorthwindConnectionString"
connectionString="Data Source=ARAS02-XP;Initial
Catalog=Northwind;User ID=sa"
providerName="System.Data.SqlClient" />
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
<pages theme="Theme1" />
</system.web>
</configuration>

You can observe <connectionStrings> section in above sample
which contains connection string information.

Add new form to your existing project and add the below
method EncryptConnString() to code behind of the form. We
will use RSAProtectedConfigurationProvider model to encrypt
the connection strings. We will try to analyze this magic
piece of code. Let's start with namespaces. The
System.configuration namespace contains classes which deal
with the configuration information associated with client
applications and ASP.NET applications. The
System.Web.Configuration.WebConfigurationManager class is
the preferred way to provide programmatic access to
configuration files of ASP.NET web applications. You can use
one of open methods provided by WebConfigurationManager that
return configuration object which in turn provides the
required methods and properties to handle the underlying
configuration files. The GetSection method of configuration
object returns the connectionStrings section object for the
web.config file.

using System.Web.Configuration;
using System.Web.Security;
using System.Configuration;

public void EncryptConnString()
{

Configuration config =
WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section =
config.GetSection("connectionStrings");
if (!section.SectionInformation.IsProtected)
{

section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");
config.Save();
}
}

Encrypting Connection string using
RSAProtectedConfigurationProvider model

You can observe in below listing that connectionStrings
section is encrypted when we execute above method using
RsaProctectedConfigurationProvider model.

<connectionStrings
configProtectionProvider="RsaProtectedConfigurationProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>Rsa Key</KeyName>
</KeyInfo>
<CipherData>
<CipherValue>
NQPKYTuUVO5SWpxXdBUpoMKYYUmEBBuAw8LXe+DxMYrkMzzAJsUVw6uZZLJXWa9ipAEx
hvS2hhkGx7MHkpustn+IT+PpuxtIKSDFkumZdA/3kcaHuSO74M75Qt+BmW42v/KWNwVv
7umXLz78ka4jDeY/yf2BMpkcs35TkSS9PVM=</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>
MVKe6xdu6h4DqGHmzuzeBqaWcL+m+Rl0EHi9uwQAqhZ9N56HzGgC66cXEiDJ8IGaSCrAYm
7z2ERQYKwjMyTJMkiJ3cSk7CSgqxfrT3+7+DzzKMkB489AmADfxtRyt3JE0bWIclhsHgLn
YthS6mMiXTusSzRIcPMESb+ZAIkyCTPt6+2BxDNimgFX42Xt7abvNinknaUk
uJYKr7tgOzVfS00IesVA/jou1t8FTjM14b9YGvHPtBDq00Jm/cD9iGtP2OM6RnhLgy+MUr
3NPiuWutsEcUGELfOwkMvKQ6Igsg6eqae4c0dZlg==</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>

Similarly, we can encrypt connectionStrings information
using DataProtectionConfigurationProvider model. Use the
same above method and replace parameter for ProtectSection
method with DataProtectionConfigurationProvider as shown below.

section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");

<configuration>
<appSettings/>
<connectionStrings
configProtectionProvider="DataProtectionConfigurationProvider">
<EncryptedData>
<CipherData>
<CipherValue>
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcHu0TgBbIEyfG1RWWqIDSgQAAAACAAAAAAADZg
AAqAAAABAAAACSAX+UlFBbL2xUT1mYruSgAAAAAASAAACgAAAAEAAAAODHdp8b3SFHl8S6
yVQ/Ydu4AQAAitMpkAI8SjZc349E63yEAV/mVQzOv29H2mXvz2j+2kg8FTGYV95xySZrUH
ICx/i5hBq//iQNc1v/Jp0xLxJf6+K/nSQwJTnGWBn3555HJHKU8yAeQCN9Iw/6YWs/q6oV
GpPwMmoSe6jS+5bHzThxQrpUqxVXB4aHKeVnAfjcdj5bIBKe9jaZ0kP31UVlB9TB5z+94G
a6LNWuWWcZf/iAfrZ/EZMkEcGJE20Reb3XSm/e+LN1di2YyRxXVYV+b6MDTi7DgHC7ilZs
g+/81jCn2UtW4k74wKDXrTjAS3LgWxBdFEUPnwSKbKF+/DF24MVECZ6t7oyxoPH7OqaxR/
IDnPLxHAqtd8eT9VKmzouULpQBwrO6echS1MJL8zmvCNMsLz1JnyBlwxYvst8tQs+5MCIn
dQ1K9615hLiwP/JIUy9T3Hk1pCn37m8tEV+meRguS1yIOXMQ3nsPUI5d1C+Nt4068EecEk
uoWujCEUHu9JcpZa2KVsnSYLix5MOEvqGPtbSMmTt7TE7leicEpEn6Hm3LWYQE2N85Skpt
x5AN/Pfuwl42fMzzs07ZhRFtLDwku/a2/ZQahHIUAAAAdOITPi1vY6agWisqaA6+H/qOoc
s=</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
<pages theme="Theme1" />
</system.web>
</configuration>

Encrypted Connection String using
DataProtectionConfigurationProvider

You can in the similar way decrypt connection strings
information using below method.

public void DecryptConnString()
{
Configuration config =
WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath);
ConfigurationSection section =
config.GetSection("connectionStrings");
if (section.SectionInformation.IsProtected)
{
section.SectionInformation.UnprotectSection();
config.Save();
}
}

Remember, we cannot encrypt all sections of web.config file
using this above programmatic approach. There are few
sections which need some additional steps before we can
encrypt them with above approach.

*

<processModel>
*

<runtime>
*

<mscorlib>
*

<startup>
*

<system.runtime.remoting>
*

<configProtectedData>
*

<satelliteassemblies>
*

<cryptographySettings>
*

<cryptoNameMapping>
*

<cryptoClasses>

In order to encrypt these configuration sections you must
encrypt the value and store it in the registry. There's an
aspnet_setreg.exe command-line tool to help along with this
process.

Answer / anand gopal makwa munger

write the code on web.config file Like below

<configuration>
<appSettings/>
<connectionStrings>
<add name="Connection" providerName="System.Data.SqlClient" connectionString="server=abc\Sqlexpress;IntegratedSecurity=SSPI;DataBase=XYZ"/>
</connectionStrings>
</configuration>

and write the code Behind page(ie .cs File)

ConnectionStringSettings con = ConfigurationManager.ConnectionStrings["Connection"];
SqlConnection conn = new SqlConnection(con.ConnectionString);

How many web.copnfig can exists in a web application & which will be used ?

3 Answers   MMTS,

---

What is difference between asp.net and asp?

0 Answers  

---

How to find last error which occurred?

0 Answers  

---

About dataset and data mining ?

1 Answers   Cognizant,

---

WHAT ARE DEFFERENCE BETWEEN DATALIST AND DATAGRID

1 Answers   Seion Infotech,

---

What is role manager work in web.config? how to restrict perticular pages from the users using the role manager?

1 Answers   Patni,

---

What do you mean by authentication and authorization

3 Answers  

---

What are early binding and late binding.

0 Answers  

---

Why is global asax is used for?

0 Answers  

---

What is Web Application?

2 Answers   HCL,

---

What is data reader in asp.net?

0 Answers  

---

Why would a company use an application service provider?

0 Answers  

---