6

Currently I'm storing my C# mysql connection informations inside the class file itself, which doesn't seem that smart, since end users could simply use a reflector to view the source code in case it's not obfruscated.

How could I store those informations in a safe way?

Source code:

private void Initialize()
{
    server = "xxx";
    database = "xxx";
    uid = "xxx";
    password = "xxx";
    string connectionString;
    connectionString = "SERVER=" + server + ";" + "DATABASE=" +
    database + ";" + "UID=" + uid + ";" + "PASSWORD=" + password + ";";

    connection = new MySqlConnection(connectionString);
}
Facundo La Rocca
  • 3,786
  • 2
  • 25
  • 47
user7347727
  • 125
  • 1
  • 6
  • 2
    Relying on local security isn't security of any kind. If you're remotely hosting a database that multiple isolated end-users connect to, you should expose it through a web service (API) as opposed to giving users direct access to the database. Regardless of any local security you employ, it is still pososible to obtain the connection string back. Even the password is likely to be available by reflection. It is with MS SQL connections. – ProgrammingLlama Dec 29 '16 at 13:21
  • 1
    I prefer you to store this details in web.config or app.config and make sure that they are encrypted. please check this post. http://stackoverflow.com/questions/10168240/encrypting-decrypting-a-string-in-c-sharp – Venkatesh Konatham Dec 29 '16 at 13:22
  • 1
    And if Web Service (API) not available you can at least encrypt sensitive data. It still can be obtained, but at least not by everyone. – Vladimir Dec 29 '16 at 13:23

2 Answers2

5

I'm answering this to address security for a local application, as that's what OP's situation sounds like, despite other answers treating it as if it's a web application.

If a single database is shared by multiple users with different security concerns, as I suspect it is, then you really shouldn't store the database connection string locally, in the code, in the config, encrypted in the config, etc. The client should never have this information. This is the only way to truly guarantee security client-side.

A determined person can simply reverse-engineer your code, and unencrypt the connection details. Furthermore, if they use something like .NET Reflector do debug your code, they can use reflection to pull the connection string, including password, out of the connection object. Then it's trivial for them to connect directly to your database and extract any information they want. Of course you could have an IP whitelist, but if one of those users is bad then you still have the same issue.

My recommendation is that you create a web service which will manipulate your database. The software that your end-users use then simply authenticates itself with the web service using the user's credentials and then uses that to access resources they are allowed to. This is how many modern applications operate.

If each user has their own database then you can simply store the connection string encrypted locally, as this will be enough to prevent most problems, except for malicious people with access to the users' machine.

Obviously, as Vladimir said, you can take this as a general solution (encrypt it in the config and hope for the best), but I really don't recommend this if any security is required. For example, if you are storing user passwords in the database - even in hashed form - this is not a secure idea. The risk you'll run with using this method for everyone is that somebody could steal all of your data, or wipe all of your data, or even manipulate the data to their advantage.

ProgrammingLlama
  • 36,677
  • 7
  • 67
  • 86
3

The standard way to protect connection strings in .NET is to encrypt them in your config file.

aspnet_regiis -pe "connectionStrings" -app "/SampleApplication"

You will need to grant access to the application to use the key to decrypt this when it runs, see the MSDN article on secure connection strings.

Fenton
  • 241,084
  • 71
  • 387
  • 401