db connection string in web.config

[J Jones]

Hi,
I feel a bit foolish having my db connection sting, with password/username
in my web.config file. It just dont seem right, its a bit insecure surley?
Where is a better place for it?
Thanks.
Jim.

 

[Eugene Jenihov]

Hi

http://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.asp

 

[Scott Allen]

In certain environments it certainly is risky.

Take a look at the application configuration block from MS which
supports encryption and signing of config information.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/cmab.asp