Is it safe to commit dev and production connection strings that use windows account credentials without username and password?

user_4996792 0
Viewed 106

Are the following connection strings safe to commit to version control? If not what dangers can arise. For example if I had the following connection strings with Integrated Security=True set:

In appsettings.Development.json

"ConnectionString": "Data Source=MYDEV\\SQLEXPRESS;Initial Catalog=MyDevCatalog;Integrated Security=True"

In appsettings.Production.json

"ConnectionString": "Data Source=MYPROD\\SQLEXPRESS;Initial Catalog=MyProdCatalog;Integrated Security=True;Connect Timeout=30;Encrypt=False;TrustServerCertificate=False;ApplicationIntent=ReadWrite;MultiSubnetFailover=False"
asp.net-core connection-string c#
1 Answers

No harm done by committing it to the version control in case like this, but as a best-practice it is frowned upon.

From: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html#storing-database-credentials

Database credentials should never be stored in the application source code, especially if they are unencrypted. Instead, they should be stored in a configuration file that:

Is outside of the webroot. Has appropriate permissions so that it can only be read by the required user(s). Is not checked into source code repositories. Where possible, these credentials should also be encrypted or otherwise protected using built-in functionality, such as the web.config encryption available in ASP.NET.

user_70203120
Related