Monthly Archives: February 2004

Do you put your connection strings in web.config?

dotNET

Don’t we all? Isn’t it what we were told to do. ASP.NET protects the web.config file so nobody can browse to it and see your connection strings, logins and passwords and whatever else you have hidden in there. Right?

But guess what, that’s just not good enough anymore! Hackers who know how to get into your webserver and get around asp.net can get at the web.config file.

This is one of the things we are talking about in the DevDays ASP.NET Security track.

One of the ways to protect the strings is to encrypt them (which isn’t so hard) but decrypting them *is* (and should be, if you think about it…). DPAPI (a win32 api – not managed code) is used to handle the keys for encrypting and decrypting your data but it is pretty confusing to use especially if you are not used to dealing with unmanaged code. (In that case, if you want to get more comfy with that, keep up with Sam Gentile’s MSDN series on COM Interop.)

Enter the Configuration Management Application Block for .NET . Among it’s features is it’s ability handle this encryption/decryption for you.

How does the Configuration Management Application Block improve the security and integrity of application configuration data?

Regardless of the type of data or the store in which the data is held, you can configure the Configuration Management Application Block to use the data signing and encryption services provided by a Data Protection Provider. The Configuration Management Application Block provides two Data Protection Provider implementations and the extensible architecture of the Configuration Management Application Block means that you can easily seamlessly integrate your own Data Protection Provider implementation

Phew! (You’d be saying that too if you looked at the code for working with DPAPI.)

Also – Whidbey will have a managed wrapper for DPAPI so a lot of this will be easier to do yourself down the road. My understanding is that this is actually related to the work that was done for the App Block. (Or maybe the other way around?)

asp.net 1.1 provides auto-protection from scripting attacks

dotNET

Did you know that ASP.NET v1.1 automatically checks for possible scripting attacks when users enter info into you forms? I didn’t! I learned it in my prep for my DevDays session.

So this:

(with Errors =”Off” in web.config) results in this: (click to enlarge)

This protection is on by default. It is controlled in a few places. See this article on Microsoft’s ASP.NET site for more details.

When a client calls to say “thanks”

Just Rambling

Makes my day. The owner of my favorite/biggest client treats me like a business partner. He tells me his visions and let’s me do whatever I think it takes to make them a reality. He pays me plenty. I love the company and over the past 7 years of working with them have a great sense of ownership of what goes on there and am very proud of my contributions. But still, he pays me plenty. So to have him stop to tell me “thanks for everything” means so much to me. He said what we have accomplished in the past year is now setting his company up for another fantastic growth spurt. He knows that my dedication to his company goes much deeper than my billables. I am *so* incredibly fortunate to have a client like this.

Building relationships with clients is what keeps you in business. Every time I have ever been asked to talk about this side of my business (I have been a contractor for nearly 18 years now) this is always the most important factor that I highlight.

Why I should think harder before I post about politics…

Purely Personal

Avonelle, James, Andrew, Scott – I absolutely respect everything you are saying which is why I am leaving your comments in tact.

I do not have the energy or heart to keep trying to fix what I have written to express properly what I am saying so that it does not insult anyone other than possibly the one person I was writing about – nor do I have the courage to even attempt to debate this with you. I am not expressing myself well. You all are very clear with what you are saying.