How do I keep ASP.net connection string passwords secure on a git repository?

user_3541717 0
Viewed 5435

Up until now I have been using gitignore to ignore my web.congfig and web.release.config files so that my connections strings (including passwords) do not get stored in the git repository.

This has been fine with changes to the web.config being passed around on encrypted removable media.

BUT I have just started to look at using continuous integration and storing my code on Visual Studio Team Services. For this to work (unless you can suggest a fix) I must have the web.config included as part of the project.

I am hosting the application on a windows server (in-house) with MSSQL DB and a connection to an Oracle DB on different server.

I'm not the most advanced developer but holding my own so far. All support greatly welcomed.

continuous-integration asp.net git c#
5 Answers

From the docs about Connection Strings, "In ASP.NET Core the configuration system is very flexible, and the connection string could be stored in appsettings.json, an environment variable, the user secret store, or another configuration source."

Configuration in ASP.NET Core details each of these approaches

  • Settings files, such as appsettings.json
  • Environment variables (my personal favorite)
  • Azure Key Vault
  • Azure App Configuration
  • Command-line arguments
  • Custom providers, installed or created
  • Directory files
  • In-memory .NET objects
user_99747710
Related