protect (encrypt) password in the web.config file (asp.net)

 <system.net>
  <mailSettings>
   <smtp from="<a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="650008040c0925010a08040c0b4b060a08">[email protected]</a>" deliveryMethod="Network">
    <network clientDomain="www.domain.com" host="smtp.live.com" defaultCredentials="false" port="25" userName=" <a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="23464e424a4f63474c4e424a4d0d404c4e">[email protected]</a> " password="password" enableSsl="true" />
   </smtp>
  </mailSettings>
 </system.net>

This is the case where I need encryption for my password. I searched and googled much on the web but I can’t be able to encrypt anymore.

Can anyone help me do this in a simple but secure way.

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

I wrote an article about that on my blog: http://pvlerick.github.io/2009/03/encrypt-appconfig-section-using-powershell-as-a-post-build-event

My idea was that you want the password to be clear in the IDE, but encrypted in the output folder’s web.config/app.config.

The script is

param(
  [String] $appPath = $(throw "Application exe file path is mandatory"),
  [String] $sectionName = $(throw "Configuration section is mandatory"),
  [String] $dataProtectionProvider = "DataProtectionConfigurationProvider"
)

#The System.Configuration assembly must be loaded
$configurationAssembly = "System.Configuration, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a"
[void] [Reflection.Assembly]::Load($configurationAssembly)

Write-Host "Encrypting configuration section..."

$configuration = [System.Configuration.ConfigurationManager]::OpenExeConfiguration($appPath)
$section = $configuration.GetSection($sectionName)

if (-not $section.SectionInformation.IsProtected)
{
  $section.SectionInformation.ProtectSection($dataProtectionProvider);
  $section.SectionInformation.ForceSave = [System.Boolean]::True;
  $configuration.Save([System.Configuration.ConfigurationSaveMode]::Modified);
}

Write-Host "Succeeded!"

The post-build command is

powershell "& ""C:Documents and SettingsVlericPMy DocumentsWindowsPowerShellEncryptAppConfigSection.ps1""" '$(TargetPath)' 'connectionStrings'

Method 2

This is another way to encrypt and decrypt coonection string check it if you are using vs2010 then open vs2010 with run as administrator

string provider = "RSAProtectedConfigurationProvider"; 


string section = "connectionStrings";  

protected void btnEncrypt_Click(object sender, EventArgs e)  

{ 

   Configuration confg = 
   WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); 

   ConfigurationSection configSect = confg.GetSection(section); 

   if (configSect != null) 

   { 
      configSect.SectionInformation.ProtectSection(provider); 
      confg.Save(); 

   } 

} 
protected void btnDecrypt_Click(object sender, EventArgs e) 
{ 
    Configuration config = 
        WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); 
    ConfigurationSection configSect = config.GetSection(section); 
    if (configSect.SectionInformation.IsProtected) 
    { 
        configSect.SectionInformation.UnprotectSection(); 
        config.Save(); 
    } 
}

Method 3

Here is a thread on ASP.NET forums that has some brainstorming going on and provide a few possible solutions:

How to encrypt the SMTP Node in web.config

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0