From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Encrypting Web.config

Encrypting Web.config

From the course: ASP.NET: Security

Start my 1-month free trial

Encrypting Web.config

“

- [Instructor] Another approach to protect sensitive information in web.config, just in case that someone somehow is stealing that file, is to encrypt this. And using IIS, we have the aspnet_regiis tool, which among other things registers asp.net with IIS. But it can do a bit more, it can also encrypt certain sections within that web.config file. We have aspnet_regiis, pe, the e stands for encrypt, then we provide the name typically we could encrypt the connectionStrings section because connectionStrings may contain sensitive information, and furthermore we have to provide the name of the app in which we would like to encrypt the connectionString section in web.config. We can also provide more information like which site, which encryption provider to use, etc. which you want. Then, aspnet is encrypting this part of web.config so if someone is stealing web.config, they have no idea what they should do with that encrypted information. Should you at one point eventually, would like to…

Contents