How secure is the username and password in the connection string?

Question

when developing Windows applications:

• How can I protect the username and password in the connection string?

• Organizations such as banks, did they give out the username and password of their database to application developers? if not typical, how do application developers write database connections?

• What is the industry standard for protecting user and password in connection string?

thanks

Answer 1

• How do I protect the username and password in the connection string?

Windows, , :

• , . .

• , . ACL.

, (, ASP.NET), . , .

, : . , , .

2. , , ? , ?

/. .

3. ?

" ", . 1.

Answer 2

app.config , web.config. MS .

<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
  <EncryptedData>
    <CipherData>
      <CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAH2... </CipherValue>
    </CipherData>
  </EncryptedData>
</connectionStrings>

Answer 3

MSDN:

ASP.NET 2.0 , , . ASP.NET, Windows. . .

connectionStrings , . ConfigProtectionProvider , . EncryptedData .

 <connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
  <EncryptedData>
    <CipherData>
      <CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAH2... </CipherValue>
    </CipherData>
  </EncryptedData>
</connectionStrings>

,.NET Framework CipherValue . . MSDN, , :

Answer 4

.

Example SqlCommand command = new SqlCommand ("select * from Login where Username = @name", conn); command.Parameters.Add (new SqlParameter ("@name", uname.txt)); .