Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection defined in the web.config encrypted? it's the same and it's better because entity framework, for example looks for the name of the connection in the web config of the application, Now i want to know from a security point what's better or what's the best practice??
Is it a good practice set connection strings in a web config?
web development;c#;asp.net;security;entity framework
There's no substantive difference, except that you'll have to actually build a binary if you wanted to make a configuration change if you put it in a DLL, whereas an admin could just modify the configuration with well-understood off-the-shelf tools if it's in the config. There's already a mechanism for encrypting configuration strings and additional guidance on MSDN. Current versions of Asp.Net may have alternative mechanisms, so do some additional research before committing to an approach.Just because something is sitting in a DLL, doesn't make it any more secure. A text editor can open binary files just as well, tools like Reflector can provide a nicer interface to navigating a .Net DLL; a DLL won't provide any extra encryption.