While building my Project I got a new file called MyApplication.exe.config. This is the Content of App.config (I guess) where I also included the Connection to a DataBase in <ConnectionString>.

The problem is, that the ConnectionString will shown in this .exe.config file. Is there a way to hide the .exe.config file itself (So that my Project just have the .exe and it's .dll's)?

And How can I hide the <ConnectionString> Section ?

Last time I tried to encrypt my App.config, there was the problem that I can't run the same program on other pc's (I guess cuz of RSA).

Im currently in education as an Application Developer so sorry for bad knowledge.

  • 1
    Use resources or global variable instead of your configuration but your still exposing your SQL credentials to the user. You should really use a service so you don't expose your DB to direct access. – Paul Feb 8 '18 at 14:28
  • My Application use 2 DataBases. The first for global login (my Server) to get access to the program. And the Second one is the users database. While installing the Application, the user will connect the app to his Database. So his ConnectionString will be saved into App.Config too. Then I have 2 ConnectionStrings in the App.config. I guess I can't create a "Service" for the users database. But what do you mean with "Service" ? – KushGene Feb 8 '18 at 14:34

As described in your comment you habe two databases for your application.

They have the following purpose:

  • authenticating the user
  • user specific database with data or so for your application

For authentication you should not give the user access to the database where all users are stored. There are multiple solutions.

1. Solution

If you first database only stores the information about user authentication you could use the authentication provided by the database(server) and give the user only access to the database on the server with there data

2. Solution

The databases are on different servers and you use the first database only for some kind of protection of your app usage. You could make a simple Rest Service where the user login is sent (over https) and the result tells your app if the user is allowed to access your app or not (this can be bypassed also like your database solution since the app runs on the users maschine)

Dangers of your solution

You can't really hide the connection details from the user since they could start man-in-the-middle attacks and capture your credentials. Or just search for the string in the application code (you can finde strings in exe files).

  • So I can secure my first database connection to my Server with a Web- Service, but not the enduser's database connection in the application? Even not with encryption? (App.Config should be encrypted after user connects the application with his database). Or do you mean that encrypting the ConnectionString is still attackable ? – KushGene Feb 9 '18 at 9:09
  • You could implement a service which handles both databases. I thought the second one is hosted by the user himself. If your program can decrypt the file also the user could do it since they have the code for this delivered by you. (Special case: If you can't decrypt it the user also will not be able to.) No normal end user is capable of such things. They all need reverse engineering knowledge. If you were able to hidde the credentials successful you also have to secure the connection from interception but since it is on the users computer there always will be a way. – Fritz Feb 9 '18 at 12:06
  • Oh okay. And there is no way to run a ASP.NET WebService on Linux? I tried the whole day using Plesk etc. trying to install mono via apache, nginx etc. but with Plesk / KeyHelp on Ubuntu it's not possible for my knowledge. And I cant install a Windows Server on my OVH VPS. Even no HyperV with 2 core CPU. But thx for your help :=) – KushGene Feb 9 '18 at 15:52
  • I use nancyFX but this is not the same as asp.Net – Fritz Feb 9 '18 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.