As you know, Web.Config and App.Config files are like plain readable XML files. However, it contains sensitive information such as Connection Strings, Impersonation, App Setting Keys and their values. At some point you may need to secure these sections. .NET Framework allows to make your life simple, by just executing few commands on Command Prompt or few clicks using a Enterprise Library Configuration tool, you can achieve the desired result. There is only one basic requirement you should be able to at least remotely login to the Server where you would like to make these thing. Following are few simple steps to secure web.config or app.config.
File: Web.Config using Command Prompt
1. Go to Command Prompt
2. Change Directory to C:\Windows\Microsoft.NET\Framework\v2.0.50727
3. To Encrypt a Section in Web.Cofig - type following -
aspnet_regiis -pef "<CONFIG_SECTION" "<PHYSICAL_PATH>"
i.e. aspnet_regiis -pef "connectionStrings" “C:\Inetpub\wwwroot\TestWebSite"
i.e. aspnet_regiis -pef "system.web/identity" “C:\Inetpub\wwwroot\TestWebSite"
4. Go to your website root directory, and create a File AppUser.Aspx and type the following line save it.
a. <%@ Page Language="VB" %>
<% Response.Write( System.Security.Principal.WindowsIdentity.GetCurrent().Name ) %>
b. Now, open your browser and call this page, this will show you a DOMAIN/UserName under which you website is running. Take a note of it. Now go back to command prompt.
5. Run the following command on command prompt to allow Permission to Users e.g. "NT Authority\Network Service", and the User Your Web Site is using it. run following command
aspnet_regiis -pa "NetFrameworkConfigurationKey" "NT Authority\Network Service"
aspnet_regiis -pa "NetFrameworkConfigurationKey" "DOMAIN/USERNAME"
6. After successful completion of command, remove the AppUser.Aspx file.
7. If you ever want to decrypt the section you encrypted, use following command
aspnet_regiis -pdf "<CONFIG_SECTION" "<PHYSICAL_PATH>"
You do not need to make any code change in your application for encryption or decryption, .NET automatically does it for you.
For more details you can visit http://msdn.microsoft.com/en-us/library/ms998283.aspx
File: App.Config using Command Prompt
So what would you do to encrypt the same in case of App.Config, above command only work for Web.Config. Here is a trick – Copy the contents of App.Config into Web.Config file, or you can rename as web.config. Follow the same instructions as above, and after encryption, copy the file contents or rename it back to App.Config.
Easy Way To Encrypt/Decrypt - Web.Config/App.Config
If you have downloaded and Installed Microsoft Enterprise Library Configuration Tool, just open Web.Config or App.Config and select the section you want to encrypt, Go into Protection à Protection Provider and choose a provider you want (default is none) and save the file, you are done. BUT, you may have to follow #4 - #6, if .NET is not able to read encrypted section.