Encrypt SQL Server connection string

Question

If one has a connectionstring in one's application, is there a way to encrypt the information it contains?

The connection string is created using the SqlConnectionStringBuilder object.

Or is it 'acceptable' that sensitive information is sent in plaintext to the server?

So what do you want to encryt? The (local) sql connection string that configures the client access? Or the communication on the wire between a client and a remote user? I understand you're using SQL users, not windows authentication? — Benjamin Podszun
– Benjamin Podszun, Commented Dec 26, 2009 at 10:38
I want to mainly encrypt the password that is sent on the wire to the server in the connection string. — Tony The Lion
– Tony The Lion, Commented Dec 26, 2009 at 11:27

Mazki516 · Accepted Answer · 2009-12-26 23:35:07Z

2

well you can use AES for example, to encrypt the data, send the encrypted connection string to the database computer. on that computer you need to build a listener that is getting the encrypted connection string and then decrypt it and connect to server. you need to build a softwere between the database computer and the user computer if you want to encrypt\decrypt all the data, but for the ConnectionString that the way...(encrypt -> send it to the server to a listener -> decrypt)

Hope it helps. Amit.

answered Dec 26, 2009 at 23:35

Mazki516

1,0371 gold badge11 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

James Skemp · Accepted Answer · 2011-05-04 15:41:13Z

1

Hope this helps.

Is it 'acceptable' that sensitive information is sent in plaintext to the server?

It depends on how much level of security you want for you application, as security critical apps might need encryption of the connection string.

Use encryption sparingly and judiciously though - there is a performance hit.

Edit: Changed the link, Linked to MSDN (more info)

Thanks

edited May 4, 2011 at 15:41

James Skemp

8,6119 gold badges71 silver badges116 bronze badges

answered Dec 26, 2009 at 10:42

Mahesh Velaga

22k5 gold badges41 silver badges60 bronze badges

1 Comment

Tony The Lion Over a year ago

This is good, but as my connection string is created at runtime in my application, I cannot place it in a app.config file.

Collectives™ on Stack Overflow

Encrypt SQL Server connection string

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related