The web.config file as the name implies is a configuration file where website information like connection strings, app settings can be stored.
This file is not compile by ASP.NET when you want to publish your website. It remains plain so that information on it can be view easily and this makes it come vulnerable to attack.
However, asp.net has given a feature that can enable you as programmer to encrypt sections on the file.
So what are we waiting for since this good news is true. Let's start the encryption.
When I mentioned the word encryption in this post, it simply means that securing some or all part of information so that they can be securely transmitted and even if the file is stolen accidentally or intentionally, the information will be useless since the criminal can't understand the content.
So if you want your website or app information such as database password, username, connectionStrings to be secured, you should consider encrypting the Web.Config File.
Encrypting web.config file must be done on the machine that the app is intended to run. But in a case where the app needs to be used in other machine, the container key should be exported on the machine used to encrypt the web.config file and imported to the second machine.
Enough of stories, now I should go straight to the the action.
The encryption can be done either through command prompt or using codebehind which is my favorite as you don't need any files exportation and importation.
In this post, I am going to show you the two methods, you alone can chose the one that best suits you.
This wonderful utility, aspnet_regiis developed for files encryption has made life easier for programmers.
And the good news is that you need not to pay anyone cos the tool is right there for you. This tool has many paray but the ones I shall focus on are;
-pef parameter: this is used for the encryption.
-pdf parameter: this is used for the decryption.
Before you can encrypt any section on the web.config file, you must pass the -pef parameter, section name, and path to the web.config file location.
Let's assume that you have a web.config file located in web file folder inside Local Disc C, then all you need is as follows;
1. Launch your system command prompt as administrator, at the command prompt, enter
C:\Windows\Microsoft.NET\Framework\v4.0.30319
2. Enter this
ASPNET_REGIIS -pef "connectionStrings" "C:\web file"
Note that this utility (aspnet_regiis.exe) is case sensitive. For Instance if you type connectionstrings instead of connectionStrings, it will fail.
Also, web file is the folder where the web.config file is located.
Open the web.config and check if the connection string is encrypted. If you done it well, you should see something like below when you open the web.config file.
<configuration>
<connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>Rsa Key</KeyName>
</KeyInfo>
<CipherData>
<CipherValue>ZbDTF00MYzUUW5U3w3PU0rfiAH1UKhvuLSNWPmB/YifBKne6HAWfVc3CnKVimyP8SFyamaR5oAIAxj/xavfpox8EOYXNI+afsksiuA5huSDupCZKNuXq+VCZrdIyn6YOq+W7s3Ojlu7q9VwKcoKurl28l2hcPvWkBk11KYB7hr0=
</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>42IPPRUjJxCNDHEBLCAJI4/NyLpLueZSBzUXO69lVdZU8+nLpxO+opnbZNxqddyzNnbCO1Uk2Da3ljExkqnLIxT2zs90JAhZvJ5ljIgCipq7ZEp7zHOpvTH9fBGoZJJWhgdddOrHZsLDE9mILjlvBHDhPQrYcMHtY6oLIbxJq92it82iBJv0fS7v1S/o0p4hAtfky+6hXCZWSKUJHr88NDrKe2EEK3mazD2QD5Ozf/w=
</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
</configuration>
Should in case you want to decrypt it back, run this command:
ASPNET_REGIIS -pdf "connectionStrings" "C:\web file"
Note that web file is the folder where the web.config file is located.
To verify if the file is being decrypted, open the web.config file and should be decrypted if you done it well.
But I don't like this pattern cos it involves a lot of stress. But luckily, ASP.NET provides a mechanism through which this can be done programmatically. Fantastic!
This part is my favorite cos all you need to do is write the code and hit encrypt button whenever you chose and decrypt whenever desired.
So copy this codes;
Public Sub EncryptFile()
Dim filePath As String = Request.ApplicationPath
Dim sectionName As String = "connectionStrings"
Try
Dim dFile As System.Configuration.Configuration
Dim dSection As ConfigurationSection
dFile = System.Web.Configuration.WebConfigurationManager.OpenWebConfiguration(filePath)
dSection = dFile.Sections(sectionName)
dSection.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider")
dFile.Save()
Catch ex As Exception
ex.Message
End Try
End Sub
Now open the web.config file and you should see the encrypted file as below;
<configuration>
<connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>Rsa Key</KeyName>
</KeyInfo>
<CipherData>
<CipherValue>ZbDTF00MYzUUW5U3w3PU0rfiAH1UKhvuLSNWPmB/YifBKne6HAWfVc3CnKVimyP8SFyamaR5oAIAxj/xavfpox8EOYXNI+afsksiuA5huSDupCZKNuXq+VCZrdIyn6YOq+W7s3Ojlu7q9VwKcoKurl28l2hcPvWkBk11KYB7hr0=
</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>42IPPRUjJxCNDHEBLCAJI4/NyLpLueZSBzUXO69lVdZU8+nLpxO+opnbZNxqddyzNnbCO1Uk2Da3ljExkqnLIxT2zs90JAhZvJ5ljIgCipq7ZEp7zHOpvTH9fBGoZJJWhgdddOrHZsLDE9mILjlvBHDhPQrYcMHtY6oLIbxJq92it82iBJv0fS7v1S/o0p4hAtfky+6hXCZWSKUJHr88NDrKe2EEK3mazD2QD5Ozf/w=
</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
</configuration>
Hey, I know you must be thinking by now that how do I start over again writing codes for the decryption, my friend worry not cos I have good news for you.
The most charming and amazing part I love about this ASP.Net web.config encryption is that, when you want to connect to the connectionstrings, ASP.Net automatically decrypt this file for you meaning you don't have to worry about decryption during execution.
Since the strings are encrypted using the private key for the Web server, even if the file is stolen from the site, it can't be decrypted on any machine except the Web server. So I will advice you to only encrypt when you have move the site to your production server.
If you encrypt the connection string on the developing machine or server, and then move your site to the production server, ASP.NET won't be able to decrypt the string using the production server's private key.
There might be times we want to either add or remove information from the connectionstrings, and this can't be possible if the file is encrypted. So what should you do? The answer is through the codes below
So copy this codes;
Public Sub DecryptFile()
Dim filePath As String = Request.ApplicationPath
Dim sectionName As String = "connectionStrings"
Try
Dim dFile As System.Configuration.Configuration
Dim dSection As ConfigurationSection
dFile = System.Web.Configuration.WebConfigurationManager.OpenWebConfiguration(filePath)
dSection = dFile.Sections(sectionName)
dSection.SectionInformation.UnProtectSection()
dFile.Save()
Catch ex As Exception
ex.Message
End Try
End Sub
Voila, we are done!
Maybe on the process of trying to handle this, you might encounter errors. The errors varies depending on the IIS set up. But am going to talk about one here which is;
Parser Error Message: An error occurred loading a configuration file: Access to the path 'C:\Inetpub\...\emmason247.com.ng\...\ghyadgt.tmp' is denied.
Server Error in '/' Application.
Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.
Parser Error Message: An error occurred loading a configuration file: Access to the path 'C:\Inetpub\...\emmason247.com.ng\...\ghyadgt.tmp' is denied.
Source Error:
An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.
Source File: C:\Inetpub\...\emmason247.com.ng\...\web.config Line: 0
Click here to show additional error information:
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.8.4075.0
When you encounter this error, trust me you be devastated cos it will be as if you don't know what you are doing. No, you are doing well. Hahaha!!!
What causes this error is when you didn't give ASP.Net full writing permission to your web.config file. So what should you do now? Grant write access to the web.config file and the user account that will access the file.