Best Practice Tips When Connecting an ASP.NET Application to SQL Server

Question

I have an ASP.NET application that uses membership functionality. I am connecting to a SQL Server database containing an aspnet_membership schema. I am currently using "sa" and the sa password in my application connection string, which I know is a terrible task. My question is, what is the best alternative for a connection string? Should I create a user in sql db name "MyAppUser" (or something else) and assign an aspnet_membership_fullcontrol scheme for this user? Thus, the application can connect and gain full control rights, and then restrict access for individual users in accordance with the logic that I wrote in the application.

Is this a good way to do this? (access is limited to the specific database used by the application, and not to any other).

If not, what is the best way to avoid using the user "sa" in my connection string when using ASPNet membership?

Thanks for any advice you can give.

Answer 1

If this is an internal application, you can use Windows authentication (integrated security = true), otherwise create an sql login application for your application, map the db to the user and apply the appropriate permissions (maybe read / write).

Answer 2

- app.config web.config .

, , , , .

Answer 3

Windows Windows. /, / appsetting.

asp.net -. connectionstring -

, , : http://msdn.microsoft.com/en-us/library/ff647398.aspx