Easily encrypt asp.net 2.0 Web program configuration information

First, Introduction

When creating ASP.net 2.0 applications, developers typically store sensitive configuration information in Web.config files. The most typical example is the database connection string, but other sensitive information included in the Web.config file includes SMTP server connection information and user credential data, and so on. Although ASP.net can be configured by default to deny all HTTP requests for file resources with the extension. config, the sensitive information in the Web.config can still be stolen if a hacker can access the file system of your WEB server. For example, you may accidentally allow anonymous FTP access to your site, allowing a hacker to simply download your Web.config file via the FTP protocol.

Thankfully, ASP.net 2.0 helps alleviate this problem by allowing you to encrypt the selected parts of the Web.config file, such as thesection, or some custom config sections that your application uses. The configuration section can easily be encrypted using either encoding or Aspnet_regiis.exe (a command-line program). Once encrypted, the Web.config setting avoids "eyeing" the eyes. Also, when you programmatically retrieve the encrypted configuration settings from your asp.net page, ASP.net automatically decrypts the encrypted portions that it reads. In short, once the configuration information is encrypted, you do not need to write any other code in your application or take any further action to use the encrypted data.

In this article, we'll discuss how to programmatically encrypt and decrypt the configuration Settings section, and analyze the use of command-line program aspnet_regiis.exe. We will then evaluate the encryption options provided by ASP.net 2.0. In addition, we will briefly discuss how to encrypt the configuration information in the ASP.net version 1.x.

Second, the premise

Before we begin to explore how to encrypt asp.net 2.0 configuration information, keep in mind the following points:

1. All forms of encryption contain some kind of secret, and the secret is used when encrypting and decrypting data. Symmetric encryption algorithms use the same key when encrypting and decrypting a message, whereas asymmetric cryptographic algorithms use different keys for encryption and decryption. Whichever technique you use, the most important thing is to see how securely the decryption key is saved.

2. The configuration encryption technology provided by ASP.net 2.0 is designed to prevent hackers who are able to retrieve your configuration files in some way. The idea is that if you have a Web.config file on the hacker's computer, then he can't crack the encrypted part. However, when a ASP.net page on a Web server requests information from an encrypted profile, the data must be decrypted to be used (and you do not need to write any code at this time). So if a hacker can upload a asp.net web page that can query the configuration file and display its results to your system, he can view the encrypted settings in plain text. (For more information, refer to the sample ASP.net page provided in this article, which shows the ways to encrypt and decrypt parts of the Web.config file; As you can see, a asp.net page is able to access (and display) the plain text form of the encrypted data)

3. Encryption and decryption of configuration information requires a certain performance cost. As a result, it is usually only the configuration part that contains sensitive information that is encrypted. For example, you might not need to encrypt theorconfiguration section.

III. Encryption of what information

Before we analyze how to encrypt asp.net 2.0 configuration information, let's first look at what configuration information can be encrypted. Use. NET Framework 2.0, developers can encrypt most of the configuration parts in Web.config or machine.config files. These configuration sections are XML elements that are child nodes of aor element. For example, the following example Web.config file contains three configuration settings, explicitly defined as:

＜connectionStrings＞，＜compilation＞和＜authentication＞。
＜?xml version="1.0"?＞
＜configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"＞
＜connectionStrings＞
 ＜add name="MembershipConnectionString" connectionString="connectionString"/＞
＜/connectionStrings＞
＜system.web＞
 ＜compilation debug="true"/＞
 ＜authentication mode="Forms" /＞
＜/system.web＞

Each of these sections can be selectively encrypted or implemented programmatically or through Aspnet_regiis.exe (a command-line tool). When encrypted, the encrypted text is stored directly in the configuration file. For example, if we were to encrypt thesection above, the resulting Web.config file might look like this: (Note: Space is limited, we omit a chunk)

＜?xml version="1.0"?＞
＜configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"＞
＜connectionStrings configProtectionProvider="DataProtectionConfigurationProvider"＞
＜EncryptedData＞
 ＜CipherData＞
＜CipherValue＞AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAed...GicAlQ==＜/CipherValue＞
 ＜/CipherData＞
＜/EncryptedData＞
＜/connectionStrings＞
＜system.web＞
 ＜compilation debug="true"/＞
 ＜authentication mode="Forms" /＞
＜/system.web＞

In addition, there are some configuration parts that you cannot use to encrypt the technology:

·

·

·

·

·

·

·

·

·

·

To encrypt these configuration parts, you must encrypt the values and store them in the registry. There is a aspnet_setreg.exe command-line tool to help you implement this process, and we'll discuss this tool later in this article.

The difference between "hint" Web.config and Machine.config:

The Web.config file specifies the configuration settings for a particular Web application and is located under the root directory of the application, while the Machine.config file specifies the configuration settings for all sites on the Web server and is located in the $windowsdir$\ The Microsoft.net\framework\version\config directory.