I understand this question can be general but, specifically with regards to ASP.NET MVC, what's the best way to keep passwords locally but not in git/svn? My database connection string is currently in web.config -- is it best to somehow include a file in web.config that isn't in git? What do you folks do?
1
-
2On think that comes to mind is setting svn:ignore on web.config and including web.config.sample instead.Andrew Savinykh– Andrew Savinykh2011-04-12 04:18:43 +00:00Commented Apr 12, 2011 at 4:18
Add a comment
|
3 Answers
I use Windows Auth with my databases, so the connection string contains a server name but not a username/password.
For Machines where I can't use Windows Auth, I use web.config transforms and add the web.dev.config to my .gitignore.
Comments
Regarding Git, I would use a filter driver in order to build the right web.config out of:
- a
web.config.templatefile, - an external (encrypted) source where to look for the password.
On every checkout, the 'smudge' script would be the right web.config content, that way:
web.configremains private (only visible in your working tree)- common parts of the
web.configwhich don't change often and are public information remain versioned inweb.config.template. - the password, even encrypted, don't get replicated from repository to repository.
Comments
put the web.config in your .gitignore file. The web.config will not change very often.
