Is it a mistake to put passwords in an .asmx.cs file on the web server?

[John]

Hi,

I'm building a web service which connects to a database. I have
hardcoded the connection string in the web service source code (an
asmx.cs file).

Is this a mistake? Is there someplace else I should put the database
connection string or just the password?

BTW, is it a bad idea to leave .asmx.cs files on the web server? I
don't think they need to be there for the app to function. I wonder
why Visual Studio doesn't leave them on my local disk?

Thanks,
John

 

[Marina]

There is no need to put the .cs file up there, since everything is compiled.
It is recommended that you do not hard code passwords or connection strings,
since every time that changes, you have to recompile. It is much easier to
change a configuration file.

I don't know how you are copying the files over, but VS.NET probably thinks
you want the whole project up there if that is what you are copying.

You can just copy all the necessary files by hand, so only the minimal is
there.

 

[Scott Allen]

Are you using "Copy Project"? If so, you should see the option to copy
"Only the files needed to run the application", which won't put source
files on the server.

HTH,

 

[John]

Thanks for your posting.

I started Visual Studio and told it I wanted to create a new web
service. It asked for the URL and I gave the URL to my site (hosted by
a hosting company).

Is there something I should do to tell VS to not upload the cs files?
I really like that when I press CONTROL-ALT-B the solution is built
and uploaded to the server for me to test.

I see that the solution is stored locally. I kind of like this because
I can take the .sln file home with me and all the code is on the
hosting server so as long as I delete my VSWebCache directory I can
work on the code from both places. Is this a bad thing to be doing?

John

 

[John]

Thanks for your reply.

Where should I put the password and connection strings if not hardcoded?

Do you know how to tell VS to not put the whole project up on the server?

Thanks,
John

 

[Scott Allen]

Hi John:

When you create the web service in this fashion there there is no way
to keep the source code files off the server. There is nothing
inherently wrong or bad about this approach - it's whatever you feel
comfortable with.

I would be uncomfortable because I'm afraid I might put a bug into the
service and have it appear on the server before I have a chance to
test it. I would create the web application on my local machine. After
writing some code and doing some testing, then I'd upload it to the
hosting provider.

--s

 

[John]

Is there a way to tell Visual Studio to not put .cs and other
non-necessary files on the server when creating/compiling a web
application?

Thanks,
John