Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 385Note The process account is determined by the process in which your data access assembly runs.This is usually the ASP.NET process or an Enterprise Services server process if your solution usesan Enterprise Services middle tier.Alternatively you can consider using HKEY_CURRENT_USER, which providesrestricted access. For more information, see the “Registry” section in Chapter 7,“Building Secure Assemblies.”Note If you use the Visual Studio.NET database connection Wizards, the connection strings arestored either as a clear text property value in the Web application code-behind file or in theWeb.config file. Both of these approaches should be avoided.Although it is potentially less secure than using a restricted registry key, you maywant to store the encrypted string in the Web.config for easier deployment. In thiscase, use a custom name-value pair as shown below:...To access the cipher text from the element, use theConfigurationSettings class as shown below:using System.Configuration;private static string GetConnectionString(){return ConfigurationSettings.AppSettings["connectionString"];}Do Not Use Persist Security Info=‘True’ or ‘Yes’When you include the Persist Security Info attribute in a connection string, it causesthe ConnectionString property to strip out the password from the connection stringbefore it is returned to the user. The default setting of false (equivalent to omittingthe Persist Security Info attribute) discards the information once the connection ismade to the database.