Storing and Reading Base64 Encoded Connection String in Web.Config
Introduction
Many people store database connection string in web.config file. However,
web.config file being an XML file, the data stored there is in clear text
format. This is especially important for connection strings because anybody can
easily see your database details including user id and password. In this article
we will see how you can encrypt values stored in web.config using Base64
encoding and later on decrypt them in your code. Note that Base64 encoding is
not a secure algorithm but it is a quick and easy way to hide the connection
string details from casual readers.
Storing custom values in web.config
You store custom configuration values in web.config using <appSettings>
section. The section looks like this:
<appSettings>
<add key="connectionstring"
value="data source=.\vsdotnet;initial
catalog=Northwind;user id=sa;password=mypassword"/>
</appSettings>
In short you store key-value pairs inside the <appSettings> section.
Encrypting connection string
In order to encrypt above connection string we will be using System.Convert
class. We will build a small console application that allows us to pass plain
connection string as command line argument and then displays encrypted version
on the console.
The code looks like this:
Public Shared Sub Main(args() As String)
Dim data() As Byte = System.Text.ASCIIEncoding.ASCII.GetBytes(args(0))
Dim str As String = Convert.ToBase64String(data)
Console.WriteLine(str)
End Sub
Here, we are using System.Text.ASCIIEncoding.ASCII class to convert the
connection string to an array of bytes. This is necessary because the Convert
class function ToBase64String() expects array of bytes and then returns Base64
encoded version of it.
You can invoke above application (I created it as Base64Encrypter.exe) at command prompt like this:
Base64Encrypter.exe "data source=.\vsdotnet;initial catalog=Northwind;user
id=sa;password=mypassword"
The output will be:
ZGF0YSBzb3VyY2U9Llx2c2RvdG5ldDtpbml0aWFsIGNhdGFsb2c9Tm9ydGh3aW5kO3VzZXIgaWQ9c2E7
cGFzc3dvcmQ9bXlwYXNzd29yZA==
You can now copy-paste this encoded version of the connection string in the
web.config. The new appSettings section will look like this:
<appSettings>
<add key="connectionstring"
value="ZGF0YSBzb3VyY2U9Llx2c2RvdG5ldDtpbml0aWFsIGNhdGFsb2c9Tm9ydGh3aW5kO3VzZXIgaWQ9c2E7
cGFzc3dvcmQ9bXlwYXNzd29yZA=="/>
</appSettings>
Reading the encrypted connection string back
Now, let us see how we can read the encrypted connection string and decrypt
it so that we can use it further.
Dim data() As Byte = Convert.FromBase64String
(ConfigurationSettings.AppSettings("connectionstring"))
str = System.Text.ASCIIEncoding.ASCII.GetString(data)
Here, we again used the Convert class and called its FromBase64String
function. This function accepts Base64 encoded string and returns a byte array.
In order to retrieve the appSetting value we used ConfigurationSettings class as
shown above. Finally, we used ASCII class again to convert the byte array to a
string.
Summary
In this article we saw how to encrypt and decrypt your web.config values
using Base64 encoding. Note that Base64 encoding is NOT a secure algorithm but
it hides the connection string details from causal readers. You can use some
stronger cryptographic algorithm if you wish.
