Using SQLServer Session State without connection string in web.config

[Chris Snyder]

Hello all. I have a problem that is probably failry easy to solve, but
I don't know where to look. (Or, really, what to look for.)

My customer has a tool (written in .NET) that encrypts strings. They
require us to use the tool to encrypt the connection strings to the
"real" database. We have had no problem with that.

However, they also want to use SQL Server to manage session state, and
would really like the ConnectionString to the SQLServer DB that
manages session state to be encrypted/managed thru the same library,
and NOT stored in the web.config. The application stores the encrypted
string somewhere else.

What I'm trying to ascertain is if there is something that I can hook
to, possibly writing a custom library, so that instead of IIS looking
up the Connection String in the web.config file, it would ask my
library to give it the connection string.

As you can no doubt tell, I'm not really sure what I'm asking.
Hopefully, I've given enough information to point me in the right
direction.

Thanks again,
Chris

 

[Nicole Calinoiu]

Chris,

Would use of the aspnet_setreg utility (see
http://support.microsoft.com/default.aspx?scid=kb;en-us;821616) be
sufficient? This would allow for use of an encrypted connection string,
albeit not using their preferred library.

Unfortunately, the existing session state loading mechanisms seem to allow
for no other modifiers that would permit specifying an alternate decryptor,
so it would seem there's no way to get your client's desired behaviour
without subclassing the HttpApplication to use an alternate IHttpModule for
session state. That would probably be much more work than it's worth, given
that aspnet_setreg provides a reasonable solution if the main goal is
encryption, rather than encryption with a particular library.

HTH,
Nicole