Encrypting Web.config and App.config

<< Got Amazon Milk? | Home | Upgrading Strategy Using WiX >>

Encrypting Web.config and App.config

Recently I got a chance to play around with the Data Protection Application Programming Interface (DPAPI). With .NET 2.0 installed, you can encrypt your Web.config just by using aspnet_regiis.exe on the command line.

aspnet_regiis.exe -pe "connectionStrings" -app “/YourWebSite” –prov "DataProtectionConfigurationProvider"

You can read the ConnectionStrings section back using ConfigurationManager as if the file is not encrypted. That is all you have to do, the encryption is transparent to your application.

This encryption works great for Web.config, however, it does not work if you want to encrypt the App.config for non web based applications. The aspnet_regiis is hardcoded to look for Web.config.

One can programatically encrypt just as easily:

Configuration configuration = ConfigurationManager.OpenExeConfiguration(appConfig);

ConfigurationSection section = this.configuration.GetSection("connectionStrings");

if (!section.SectionInformation.IsProtected) {

section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");

section.SectionInformation.ForceSave = true;

configuration.Save(ConfigurationSaveMode.Modified);

}

To decrypt just do the oposite:

if (section.SectionInformation.IsProtected) {

// …

section.SectionInformation.UnprotectSection();

// …

}

The same code above can work for Web.config and App.config. For Web.config I would use WebConfigurationManager.OpenWebConfiguration(webConfig). For our environment we have a web project and some winform projects, so it is easier for us to create a simple tool to maintain both configuration file types.

Print posted @ Sunday, December 10, 2006 9:18 PM

Feedback

# re: Encrypting Web.config and App.config

"...
For our environment we have a web project and some winform projects, so it is easier for us to create a simple tool to maintain both configuration file types.
..."

I am looking at doing the same - however in our environment we have a Dev, Test and Prod servers. I am assuming you cant encrypt the App.config section and then simply promote the app to another server and expect it to decrypt? What 'key' (machine/user?) does the ProtectSection method use? I am aware that 'aspnet.regiis.exe' supports exporting of a key for decryption purposes, does DecryptSection also do this? 4/26/2007 7:56 PM | Sal

# re: Encrypting Web.config and App.config

Sounds like you want to use RSAProtectedConfigurationProvider instead of DPAPIProtectedConfigurationProvider in order for multiple machines to decrypt the file.

Here is an example of it: http://channel9.msdn.com/wiki/default.aspx/Channel9.HowToEncryptConfigurationSectionsUsingRsaInAspNet20 4/26/2007 9:57 PM | Aaron Feng

# re: Encrypting Web.config and App.config

this is from prasad down load 1/2/2008 3:25 AM | prasad

# re: Encrypting Web.config and App.config

But could you explain how it works, does it put any key in registry or maby some other way ? 2/4/2008 7:20 AM | Lesha

# re: Encrypting Web.config and App.config

Change App.Config to Web.Config and then use aspnet_regiis.exe to encrypt it. Change the Web.Config back to app.config.
Works like magic! 4/4/2008 12:18 AM | Anon

# re: Encrypting Web.config and App.config

# re: Encrypting Web.config and App.config

Wow - renaming it to web.config really does work - I'm impressed that the non-web-app can decrypt it automatically too. Seems silly that they hard coded it to look at web.config... 9/26/2008 9:50 AM | Sam Schutte

# re: Encrypting Web.config and App.config

Thank you guys...
It's unbelieveable how easy this is... 12/2/2008 3:53 AM | Maorino

# re: Encrypting Web.config and App.config

I want to test somethind ;) 3/17/2009 3:46 AM | test

# re: Encrypting Web.config and App.config

Many thanks for this tip - "Change App.Config to Web.Config and then use aspnet_regiis.exe to encrypt it. " 5/21/2009 1:20 PM | boomshanker

# re: Encrypting Web.config and App.config

A BIG thanks to 'Anon' for this advice:

"Change App.Config to Web.Config and then use aspnet_regiis.exe to encrypt it." 9/11/2009 3:39 PM | atconway

Aaron Feng