How can I obfuscate database authentication info during open-source development?

Question

I'm working on an open-source web application that will retrieve and display data from a database whose authentication info I would like to keep under wraps, but at the same time, I would like anyone to be able to view and contribute to the source code. The idea is that we don't want the database to be used for profit.

Is there a way to make the database schema public, but only have a few rows of each table actually visible outside of the production server? I'm using ASP.NET MVC 4 in Visual Studio 2012, hosting the code on git, and publishing to Windows Azure. I'm also using a pre-existing Microsoft Access 2007 database.

How about creating a copy of the Db, eliminate the verbose data and let the developers access only that Db, not the full one? — Quinton Bernhardt
– Quinton Bernhardt, Commented Jun 5, 2013 at 17:41

Klas Mellbourn · Accepted Answer · 2013-06-05 18:01:24Z

1

You could encrypt the connectionStrings section of the Web.config file.

How you do that is described here. The connectionStrings section would not be decryptable on any machine except the server. It would be rather inconvenient for other developers though. You could set up so that this connection string is only used when the web site is published using transforms.

edited Jun 5, 2013 at 18:01

answered Jun 5, 2013 at 17:56

Klas Mellbourn

44.7k25 gold badges146 silver badges165 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Roderick Over a year ago

Would Web.config transforms be compatible with Azure deployment from Github?

Klas Mellbourn Over a year ago

@VGambit yes, they are. Web site publishing is the normal way to deploy from VS2012 to Azure. That the code is in github does not matter.

Roderick Over a year ago

I meant something more along the lines of this: vishaljoshi.blogspot.com/2012/09/…

Klas Mellbourn Over a year ago

@VGambit Ah, I see. No, I don't know how you apply transforms when deploying azure using git. There is some documentation here github.com/projectkudu/kudu/wiki/Customizing-deployments but it does not sound like it covers transforms.

Roderick Over a year ago

I think an ideal solution might be a combination of something similar to your idea and Quinton's comment; github.com/projectkudu/kudu/wiki/Managing-settings-and-secrets I could have a testing database with only a few rows per table, and have the Web.config file point to that, which would be public. I can also have the project get deployed from Github. On the Azure end, I can modify the connection string to use the authentication info for the real database.

|

Collectives™ on Stack Overflow

How can I obfuscate database authentication info during open-source development?

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related