Encrypting Web.config and App.config

December 10, 2006 · 1 min read

Recently I got a chance to play around with the Data Protection Application Programming Interface (DPAPI).  With .NET 2.0 installed, you can encrypt your Web.config just by using aspnet_regiis.exe on the command line.

aspnet_regiis.exe -pe "connectionStrings" -app “/YourWebSite” –prov "DataProtectionConfigurationProvider"

You can read the ConnectionStrings section back using ConfigurationManager as if the file is not encrypted.  That is all you have to do, the encryption is transparent to your application.

This encryption works great for Web.config, however, it does not work if you want to encrypt the App.config for non web based applications.  The aspnet_regiis is hardcoded to look for Web.config.

One can programatically encrypt just as easily:

Configuration configuration = ConfigurationManager.OpenExeConfiguration(appConfig);

ConfigurationSection section = this.configuration.GetSection("connectionStrings");

if (!section.SectionInformation.IsProtected) {

section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");

section.SectionInformation.ForceSave = true;

configuration.Save(ConfigurationSaveMode.Modified);

  }

To decrypt just do the oposite:

if (section.SectionInformation.IsProtected) {

// …

section.SectionInformation.UnprotectSection();

// …

}

The same code above can work for Web.config and App.config.  For Web.config I would use  WebConfigurationManager.OpenWebConfiguration(webConfig).  For our environment we have a web project and some winform projects, so it is easier for us to create a simple tool to maintain both configuration file types.

This article is part of the GWB Archives. Original Author: Aaron Feng

New on Geeks with Blogs

  • We Won The One Award I Actually Care About

    Full Scale made the Inc. 5000 for the fifth year straight, the 12th listing across my three companies. Here is why the one award you cannot buy is worth stopping for.

  • Your Customers Build the Features Now

    I let a tool I liked sit dead for a year rather than build the features I wanted. An MCP server meant I never had to, and your customers can do the same to your product.

  • Get the Size of a Directory in Linux the Easy Way

    du -sh for the quick answer, ncdu for the cleanup, df for the disk itself: every command for checking directory size in Linux, plus why du and df never agree.

  • Vim Search and Replace: The Ultimate Guide

    One :%s command replaces every match in a file before a find dialog would even open. The Vim substitute patterns worth the muscle memory: flags, ranges, capture groups, and multi-file edits.