开发者

Encrypting Windows Authentication connection strings

开发者 https://www.devze.com 2022-12-12 19:57 出处:网络
I am accessing an SQL Server database using Windo开发者_如何学Pythonws Authentication Do I need to encrypt the connection string in the web.config?

I am accessing an SQL Server database using Windo开发者_如何学Pythonws Authentication

  1. Do I need to encrypt the connection string in the web.config?
  2. Does the name of the connection string (or database) matter in terms of security? (viz: ApplicationServices?


I disagree with klausbyskov. I would encrypt your connection string regardless. Sure, the server name is really all that is being exposed. But that at least puts a target out there. Encrypting the connection string would remove that target.

Knowing is half the battle.

As far as the connection string name, I'd just keep it vague, and not name it the name of your production database server or anything like that.


  1. No. It would be useless. When using Windows Authentication your app is connecting as the user that opens the DBConnection from code, typically network service if it's a web app.

  2. No, unless the name is also your domain admin password.

EDIT: In a crazy world where the name of your database server was secret, then maybe it would make sense to encrypt the connection string.

0

精彩评论

暂无评论...
验证码 换一张
取 消