Sign in Register
Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Bobi 352 posts 956 karma points
    Mar 30, 2017 @ 05:52
    Bobi
    0

    Thoughts and best practices on web.config security (encryption issues with Umbraco?)

    Hi,

    I am looking to ensure that the web.config file's sensitive db information is protected, over and above IIS's restriction to web.config...I guess I am paranoid that a coding error exists, which grants download access to the web.config file.

    What are suggestions / best practices regarding fully securing the web.config file so no access is gained by the public / hackers? I was thinking of encryption, but not sure if that will create issues in umbraco.

    Thanks :)

    Copy Link
  • Dan Diplo 1554 posts 6205 karma points MVP 6x c-trib
    Mar 30, 2017 @ 16:25
    Dan Diplo
    100

    You can encrypt a web.config file using the official procedure here:

    https://msdn.microsoft.com/en-us/library/dtkwfdky.aspx

    https://www.codeproject.com/Tips/795135/Encrypt-ConnectionString-in-Web-Config

    As far as I understand the encryption is transparent to the application.

    But bear in mind if someone can read your web.config file then your server is already compromised.

    Copy Link
  • Bobi 352 posts 956 karma points
    Mar 30, 2017 @ 16:32
    Bobi
    0

    Fair enough, and thanks. Are you aware of any testing tools that analyze server security?

    Copy Link

  • This forum is in read-only mode while we transition to the new forum.

    You can continue this topic on the new forum by tapping the "Continue discussion" link below.

    Continue discussion

Please Sign in or register to post replies