How to hide userid/password in db connection string from source?

Question

Is it possible to hide the user id and password from source when the developer can trace the source?
Sorry for my bad English.

you mean when they look at your file where you entered the connection string? — DerApe, Sep 27 '12 at 08:09
similar questions: http://stackoverflow.com/questions/40853/how-to-store-passwords-in-winforms-application http://stackoverflow.com/questions/3425908/hide-password-on-desktop-application-code — Sga, Sep 27 '12 at 08:14

score 2 · Answer 1 · answered Sep 27 '12 at 08:11

I'm guessing you are putting the connection string in the source code. If you are the first thing you should do is move it to the app.config / web.config file.

http://msdn.microsoft.com/en-us/library/ms254494(VS.80).aspx

If you are already using the app.config or web.config file can you give more details.

score 2 · Answer 2 · answered Sep 27 '12 at 08:21

If using MS SQL you can use integrated auth and simply not have user name and password in the connection string:

Data Source=myServerAddress;Initial Catalog=myDataBase;Integrated Security=SSPI;

(sample copied from http://www.connectionstrings.com/sql-server-2008)

score 2 · Accepted Answer · answered Sep 27 '12 at 08:21

2

you should keep the connectionstrings in web.config file and then encrypt the web.config file so that the passwords are safe. you can find help on how to encrypt web.config file here http://msdn.microsoft.com/en-us/library/dtkwfdky(v=vs.100).aspx

answered Sep 27 '12 at 08:21

th1rdey3

4,176
7
30
66

3

Just to clarify: the web.config is as _safe_ as the server itself. – Tim Schmelter Sep 27 '12 at 09:27

score 1 · Answer 4 · answered Sep 27 '12 at 08:09

1

A way to not store the password in the source is to make it a part of the server environment (read from a file, store it into an environment variable, etc.)

answered Sep 27 '12 at 08:09

MaxVT

12,989
6
36
50

environment variable? How to? – Meysam Savameri Sep 27 '12 at 08:12
By Googling "vb.net environment variable", I found this: http://msdn.microsoft.com/en-us/library/77zkk0b6.aspx – MaxVT Sep 27 '12 at 08:15

score 1 · Answer 5 · answered Sep 27 '12 at 08:13

1

Encrypt the connection string, more details can be found here: Encrypting Configuration Information Using Protected Configuration and Securing Connection Strings

answered Sep 27 '12 at 08:13

chridam

100,957
23
236
235

but with trace the source i can see the password. – Meysam Savameri Sep 27 '12 at 08:16

How to hide userid/password in db connection string from source?

5 Answers5