Encrypting app.config File

Question

I have an app.config file that I need to distribute with my application. It was created because of a Service Reference to an ASMX web service I added.

It isn\'t a h

Answer 1

The answer from @marc_s is awesome, but I had a little trouble understanding exactly how to do what he had mentioned. This MSDN forum answer does a really good job of explaining the same process in simpleton format for people like myself who are not programming big shots yet. Here is the breakdown:

The best way to do this is to protect it using the aspnet_regiis.exe application. Even if the application is not an ASP.NET application, this will still work. Here's how.

1. Rename the app.config in your directory to web.config (don't worry, this is just temporary, we'll rename it back later).
2. Go to the command prompt.
3. Type the following (replace the last argument with the path containing the directory to the app.config, currently renamed to web.config. For example, if the full path to the web config is "C:\documents and settings\bob\projects\myproject\web.config", you would use "C:\documents and settings\bob\projects\myproject")

%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pef "connectionStrings"

4. You should see it say "Succeeded!"
5. Reopen the web.config, it should look something like this:

  

    

      

      

        

          

          

            Rsa Key

          

          

            rUmEA8h02uMZ5M4uEVtL+5M/UvPuyJ4UJz5d/Pd4h4jpFPGVf29ha4d+BMt/iOupVisXDxuZY1jzyc6O0ZixGcCkZqbynwKjouVANQVWUnDgIFgVap2ohsxjblAMtWHTUWDlL0ST5tqSVHNQE+r9G59Bnrp5HkuU3Eg09/8j6Jo=

          

        

      

      

        U2JEHzJ+WjSdlocT00cC9TE3+Dn3v7xE1RwX7bKAPuISO2f3hm18MZHnm1hXEBlnDS6iBNRPN87+BJJvZXYz+Sis/ZD4xBZEP4jBG2F8tqlLUbagv3W4epbuTSp2aalb5rdcBoycdIzSj2CApOzSaSKkMDvZrX8yoJI9RfuGnOWmNa4bncHkUEDvWq+uCK/8uaQ48J5uRoq7O0YgIe9jDg==

      

    

  

6. Lastly, rename the file from web.config to app.config.

That's it! You shouldn't have to do anything else to get this to work. If you use the ConfigurationManager in your code to retrieve the setting, it should fetch it just fine for you using the same code.

That being said, if you're going to install this on several computers, you might want to consider providing user-specific logins to your server for each user who uses the application. That way you can still track what they do, and you can prevent them from logging on at all on a user-by-user basis.