ASP.Net Core, using version 5.0.100, and I am trying to publish my web application to a hosting provider. I am trying to figure out where to place my connection string. As of right now I have it inside appsetting.json.
"ConnectionString": {
"default": "data source=.; database= myDataBase; user id = sa; password = myPassw0rd",
}
Is this bad practice? I am worried that someone may find the connection string and hack the website. Thank you in advance!
There are several places you can put your connection string:
See the documentation for Configuration in ASP.NET Core for configuration for all of the above. Each option carries different kinds of risk, so you'll need to evaluate which one makes the most sense for your use case.
It's good that you're questioning how to best manage connection strings. Storing credentials in any configuration file like appsettings.json and web.config is a bad idea. There are a number of ways to protect your secrets. It really comes down to your specific use case. My preferred method is using Application Pool Identities. Here a a few resources to get you started.