Is it safe to store sensitive settings in a .cs file instead of Web.config?

Question

I want to save some confidential values ​​(for example, database connection strings, some passwords) in the Setting.cs file (and there in a static class).

Is he 100% sure that IIS 7 is not serving this file as plain text? Or are there any known vulnerabilities?

Answer 1

None of them are safe.

When your source files are compiled, all lines can be easily obtained with tools such as reflector or ildasm.

Config files are plain text, so any text editor can view such data.

.

Answer 2

.cs . web.config Windows\Microsoft.NET\framework\framework version\config, httpforbiddenhandler. .cs ​​ (.NET 4.0 - , ):

<add path="*.cs" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />

Edit:
ProtectedConfigurationProvider, .

Answer 3

web.config - ...

, . -, , , , , , , , .

, Silverlight, , Reflector.

Answer 4

. IIS , , ASP.NET, .

web.config?

Answer 5

ClassLibrary . . Encrypted

System.Security.Cryptography;

public class TripleDes
{
    readonly byte[] _key = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24 };
    readonly byte[] _iv = { 8, 7, 6, 5, 4, 3, 2, 1 };

    // define the triple des provider
    private readonly TripleDESCryptoServiceProvider _mDes = new TripleDESCryptoServiceProvider();

    // define the string handler
    private readonly UTF8Encoding _mUtf8 = new UTF8Encoding();

    // define the local property arrays
    private readonly byte[] _mKey;
    private readonly byte[] _mIv;

    /// <summary>
    /// Default constructor
    /// </summary>
    public TripleDes()
    {
        _mKey = _key;
        _mIv = _iv;
    }

    /// <summary>
    /// Parameterized constructor
    /// </summary>
    /// <param name="key"></param>
    /// <param name="iv"></param>
    public TripleDes(byte[] key, byte[] iv)
    {
        _mKey = key;
        _mIv = iv;
    }

    /// <summary>
    /// Encrypts the given byte array input
    /// </summary>
    /// <param name="input">Input value</param>
    /// <returns>Encrypted result</returns>
    public byte[] Encrypt(byte[] input)
    {
        return Transform(input, _mDes.CreateEncryptor(_mKey, _mIv));
    }

    /// <summary>
    /// Decrypts the given encrypted byte array input
    /// </summary>
    /// <param name="input">Encrypted byte array input</param>
    /// <returns>Decrypted result</returns>
    public byte[] Decrypt(byte[] input)
    {
        return Transform(input, _mDes.CreateDecryptor(_mKey, _mIv));
    }

    /// <summary>
    /// Encrypts the given string input
    /// </summary>
    /// <param name="text">Input value</param>
    /// <returns>Encrypted result</returns>
    public string Encrypt(string text)
    {
        byte[] input = _mUtf8.GetBytes(text);
        byte[] output = Transform(input, _mDes.CreateEncryptor(_mKey, _mIv));
        return Convert.ToBase64String(output);
    }

    /// <summary>
    /// Decrypts the given encrypted string input
    /// </summary>
    /// <param name="text">Encrypted string input</param>
    /// <returns>Decrypted result</returns>
    public string Decrypt(string text)
    {
        byte[] input = Convert.FromBase64String(text);
        byte[] output = Transform(input, _mDes.CreateDecryptor(_mKey, _mIv));
        return _mUtf8.GetString(output);
    }

    private static byte[] Transform(byte[] input, ICryptoTransform cryptoTransform)
    {
        // create the necessary streams
        using (MemoryStream memStream = new MemoryStream())
        {
            using (CryptoStream cryptStream = new CryptoStream(memStream, cryptoTransform, CryptoStreamMode.Write))
            {
                // transform the bytes as requested
                cryptStream.Write(input, 0, input.Length);
                cryptStream.FlushFinalBlock();
                // Read the memory stream andconvert it back into byte array
                memStream.Position = 0;
                byte[] result = memStream.ToArray();
                // close and release the streams
                memStream.Close();
                cryptStream.Close();
                // hand back the encrypted buffer
                return result;
            }
        }
    }
}

Answer 6

IIS , . ( .)

, , IIS, , . ( .cs , , . - )

But I would recommend encrypting configuration information using a secure configuration .