Where to store config settings in Web Service

[Chris Dunaway]

I have a web service that references a data class library which performs
SQL Server access. Since the web service is also a class library, there is
no App.Config, only Web.config. Is Web.Config the place I should store the
connection string?

If I call System.Configuration.ConfigurationSettings.AppConfig from the
data class library, will it read the settings from the web.config or will
it throw an exception?

Thanks

 

[Hermit Dave]

Web.config is certainly the place to store information like connection
string.
But you need to be careful.... web.config file is not served... but you
always consider the worst case scenario...
that someone got hold of your web.config file....

to prevent a very easy access to you database and the user name and
passwords to you database... its normally a good practice to encrypt the
connection string..
store the encrypted key in web.config file...

http://www.obviex.com/samples/Encryption.aspx

have a look at code project as well.. saw an article out there which was
pretty straight forward.... what i normally do is create a seperate assembly
which does the encyption...
and then i obfuscat the assembly using overload and string encryption. that
way it become a bit more secure...

 

[Curt_C [MVP]]

Yup