protect (encrypt) password in the web.config file (asp.net)

Question

 <system.net>
  <mailSettings>
   <smtp from="[email protected]" deliveryMethod="Network">
    <network clientDomain="www.domain.com" host="smtp.live.com" defaultCredentials="false" port="25" userName=" [email protected] " password="password" enableSsl="true" />
   </smtp>
  </mailSettings>
 </system.net>

This is the case where I need encryption for my password. I searched and googled much on the web but I can’t be able to encrypt anymore.

Can anyone help me do this in a simple but secure way.

You can move secrets out of web.config file. See asp.net/identity/overview/features-api/… — RickAndMSFT
– RickAndMSFT, Commented Mar 20, 2015 at 6:46

Philippe · Accepted Answer · 2017-03-07 08:56:17Z

6

I wrote an article about that on my blog: http://pvlerick.github.io/2009/03/encrypt-appconfig-section-using-powershell-as-a-post-build-event

My idea was that you want the password to be clear in the IDE, but encrypted in the output folder's web.config/app.config.

The script is

param(
  [String] $appPath = $(throw "Application exe file path is mandatory"),
  [String] $sectionName = $(throw "Configuration section is mandatory"),
  [String] $dataProtectionProvider = "DataProtectionConfigurationProvider"
)

#The System.Configuration assembly must be loaded
$configurationAssembly = "System.Configuration, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a"
[void] [Reflection.Assembly]::Load($configurationAssembly)

Write-Host "Encrypting configuration section..."

$configuration = [System.Configuration.ConfigurationManager]::OpenExeConfiguration($appPath)
$section = $configuration.GetSection($sectionName)

if (-not $section.SectionInformation.IsProtected)
{
  $section.SectionInformation.ProtectSection($dataProtectionProvider);
  $section.SectionInformation.ForceSave = [System.Boolean]::True;
  $configuration.Save([System.Configuration.ConfigurationSaveMode]::Modified);
}

Write-Host "Succeeded!"

The post-build command is

powershell "& ""C:\Documents and Settings\VlericP\My Documents\WindowsPowerShell\EncryptAppConfigSection.ps1""" '$(TargetPath)' 'connectionStrings'

edited Mar 7, 2017 at 8:56

answered Dec 24, 2010 at 10:11

Philippe

4,0613 gold badges44 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Saleem Over a year ago

I know it's been 4 years since this post was added, but I'll try my chances. I'm using VS2013/C#; I created EncryptAppConfigSection.ps1 and added it to "C:\Windows\System32\WindowsPowerShell\v1.0", then added "powershell "& ""C:\Windows\System32\WindowsPowerShell\v1.0\EncryptAppConfigSection.ps1""" '$(TargetPath)' 'connectionStrings'" to post-build events, but I get error on build: The command exited with code 1. Can you help me to know how to fix this?? I'm clueless about powershell scripts!

Saleem Over a year ago

I added a question about this answer. If you can help me please check it. Thanks. stackoverflow.com/questions/27302737/…

lucky One · Accepted Answer · 2012-05-08 11:29:58Z

This is another way to encrypt and decrypt coonection string check it if you are using vs2010 then open vs2010 with run as administrator

string provider = "RSAProtectedConfigurationProvider"; 


string section = "connectionStrings";  

protected void btnEncrypt_Click(object sender, EventArgs e)  

{ 

   Configuration confg = 
   WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); 

   ConfigurationSection configSect = confg.GetSection(section); 

   if (configSect != null) 

   { 
      configSect.SectionInformation.ProtectSection(provider); 
      confg.Save(); 

   } 

} 
protected void btnDecrypt_Click(object sender, EventArgs e) 
{ 
    Configuration config = 
        WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); 
    ConfigurationSection configSect = config.GetSection(section); 
    if (configSect.SectionInformation.IsProtected) 
    { 
        configSect.SectionInformation.UnprotectSection(); 
        config.Save(); 
    } 
}

decyclone · Accepted Answer · 2010-12-24 09:54:44Z

1

Here is a thread on ASP.NET forums that has some brainstorming going on and provide a few possible solutions:

How to encrypt the SMTP Node in web.config

answered Dec 24, 2010 at 9:54

decyclone

30.9k7 gold badges67 silver badges80 bronze badges

Collectives™ on Stack Overflow

protect (encrypt) password in the web.config file (asp.net)

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related