1

I'm developing a application which is not static for me. This means that creating a WebService for my connectionString will not work I guess.

Because my application works a bit like Wordpress. First you tell the application your database connectioni nfo and then the application will connect to the database. But how do I secure this connectionString?

For now I saved the connectionString in app.config which is a problem too because I can't use Settings.Default.Upgrade() when new version is out because it only upgrades the <userSettings> and not the <connectionString>.

I also tried to secure my connectionString with RSA which is a problem too, because I can't use the same programm on other PC's (for example you have a company with two employees and both have to use the programm and have access to the database).

I never worked with a WebService and I guess it will not work for me because the database connection is different for each person using the application (like it is with Wordpress).

  • I've always used the following: msdn.microsoft.com/en-us/library/… (There may be newer ways but this fits my threat model so I'm happy) – ISMSDEV Oct 23 '17 at 10:42
  • @Hector that could be the case while on the machine, but the method above I showed stops it being read once the file is removed from the server. Again as I said it meets my risk acceptance. – ISMSDEV Oct 23 '17 at 11:05
  • Apologies - I deleted it just before you posted. It sounds like (if I read correctly) OP is connecting directly to his DB from client machines. "for example you have a company with two employees and both have to use the programm and have access to the database" reinforces this. – Hector Oct 23 '17 at 11:07
  • Did you try codeproject.com/Tips/795135/… – TAHA SULTAN TEMURI Oct 23 '17 at 11:32
1

If you have different users connecting to the same database directly the only way to make it secure is to allocate each user a different database account (/password) with rights only to access their data - although this is easier said than done while maintaining a sane database layout.

If each user uses the same connection string then this means that anyone can pull the connection string out of the application and run queries directly against the database. Any kind of encryption is useless - if the app can access it at run time it needs the key. Which means anyone with access to the application files can get the key too.

An alternative would be to proxy the connection through a service which users must authenticate against (usually with a username and password). You can have them store their username/password into the application so they don't need to provide it on every launch or even store a cookie / auth token once successfully authenticated. Normally these days that would be an HTTPS based REST service. The client application sends the request to the service. This verifies the user is allowed to perform that request and handles it returning the information. This comes with the added benefit that the database can be firewalled off.

  • Thats the point. I don' know how a WebService works but i guess u need a WebServer. The Application should be simple. When installing, just type database connection info, after install -> use application. And what is when user xy is using a DataBase from Free Webhost where only 2 Accounts are available but u have 3 employees ? In this case u can't create a MySQL Account for each Application Account. – Luranis Oct 23 '17 at 11:26
  • 1
    Then this cannot be secure from anyone with access to your users PCs. The best you can do is restrict that to only your users by encrypting the config with a password provided by the user or by using something like the windows data protection API / the encrypted config support suggested by others here. But the users themselves (or anyone able to execute code on their PC under their account) still has the ability to execute arbitrary queries against the database. – Hector Oct 23 '17 at 12:22
  • So you mean the encryption with RSA? (renaming app.config to web.config etc.) ? The problem in this case is, the PC where the application was coded is working with this encryption. But if i take the application to another PC. it isnt working anymore. – Luranis Oct 24 '17 at 8:08
  • You only need to encrypt the connection string - not the entire config. And you need a mechanism to replace the database credentials. When you set up a new user you input the connection string and either have windows handle encrypting it with their user key or make them enter a password and do that. A simple "Replace Database Credentials" link when reading the conenction string fails would work. – Hector Oct 24 '17 at 8:30
  • Is there a good Tutorial about what you meaning ? I don't know to search because im not much familar with this. That's why I want to get started coding secure code. – Luranis Oct 24 '17 at 9:08
0

You can use the Data Protection API (DPAPI).

  1. String Encryption using DPAPI and Extension Methods
  2. How to: Use Data Protection
  3. Overview of Protected Configuration

"You can use protected configuration to encrypt sensitive information, including user names and passwords, database connection strings, and encryption keys, in a Web application configuration file such as the Web.config file. Encrypting configuration information can improve the security of your application by making it difficult for an attacker to gain access to the sensitive information even if the attacker gains access to your configuration file..."

  • Link-only answers are often downvoted because links die and you have to leave the site for the actual answer. I'd suggest you give a little more detail in this answer and offer the links simply as reference. – Steve Nov 22 '17 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.