0

Recently I've been studying about rewriting/replacing ConnectionString from the Web.config file. Suppose I have a 'dummy' account in my original web.config here:

<connectionStrings>
    <add name="OracleDBConnString" connectionString="Provider=MSDAORA;Data Source=ISDDEV;User ID=dummy_account;Password=password;"
      providerName="System.Data.OleDB" />
</connectionStrings>

Base on this post: How do I set a connection string config programatically in .net?, I can change the connection string from web.config dynamically but are there any negative effects if I change the connection string dynamically during runtime? Are there any 'conflict' if I have multiple users (with different accounts or conn string) accessing the system? Do you have any suggestions on what approach I can use?

The reason why I have to change the conn string is because I don't actually maintain passwords inside the database instead I use the login details of the user in the database directly. Thank you in advance.

Community
  • 1
  • 1
Mark
  • 8,046
  • 15
  • 48
  • 78

1 Answers1

1

Connection string in web.config is application-wide parameter. If you change it for one user using that reflection trick you've mentioned, it will get changed for the whole application, and other users will unintentional use it.

You can try using impersonation in pair with windows authentication, if your db provider supports it. That way user will be transparently authenticated to the database without the need for passing passwords around.

You can also create a new temporary connection string object, based on the one in web config, but with modified credentials, and then create a connection using it yourself.

alex
  • 12,464
  • 3
  • 46
  • 67