How to hide userid/password in db connection string from source?

Question

Is it possible to hide the user id and password from source when the developer can trace the source?
Sorry for my bad English.

Solution 1

you should keep the connectionstrings in web.config file and then encrypt the web.config file so that the passwords are safe. you can find help on how to encrypt web.config file here http://msdn.microsoft.com/en-us/library/dtkwfdky(v=vs.100).aspx

Solution 2

If using MS SQL you can use integrated auth and simply not have user name and password in the connection string:

Data Source=myServerAddress;Initial Catalog=myDataBase;Integrated Security=SSPI;

(sample copied from http://www.connectionstrings.com/sql-server-2008)

Solution 3

I'm guessing you are putting the connection string in the source code. If you are the first thing you should do is move it to the app.config / web.config file.

http://msdn.microsoft.com/en-us/library/ms254494(VS.80).aspx

If you are already using the app.config or web.config file can you give more details.

Solution 4

A way to not store the password in the source is to make it a part of the server environment (read from a file, store it into an environment variable, etc.)

Solution 5

Encrypt the connection string, more details can be found here: Encrypting Configuration Information Using Protected Configuration and Securing Connection Strings

View more solutions

Comments

[DerApe]

you mean when they look at your file where you entered the connection string?

[Sga]

similar questions: stackoverflow.com/questions/40853/… stackoverflow.com/questions/3425908/…

[Meysam Savameri]

environment variable? How to?

[MaxVT]

By Googling "vb.net environment variable", I found this: msdn.microsoft.com/en-us/library/77zkk0b6.aspx

[Meysam Savameri]

but with trace the source i can see the password.

[Tim Schmelter]

Just to clarify: the web.config is as safe as the server itself.