Protecting Sections of your Web.Config File

Encrypting and Decrypting Config Sections

Encrypting and decrypting your configuration sections can be done using command line tools (as explained in the article How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI ) but also through the .NET API. All you need is a few lines of code:

C#
Configuration myConfig = WebConfigurationManager.OpenWebConfiguration("/");
ConfigurationSection mySection = myConfig.GetSection("appSettings");
mySection.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
myConfig.Save();

VB.NET
Dim myConfig As Configuration = WebConfigurationManager.OpenWebConfiguration("/")
Dim mySection As ConfigurationSection = myConfig.GetSection("appSettings")
mySection.SectionInformation.ProtectSection("DataProtectionConfigurationProvider")
myConfig.Save()

This code opens the configuration at the root of the web site (indicated by "/" in the call to OpenWebConfiguration), gets a reference to the appSettings element and then encrypts the data using the DataProtectionConfigurationProvider. In order to save the changes to disk, you need to call Save(). You can use the same technique to encrypt other (but not all) configuration sections, like <connectionStrings />.

Decrypting is almost identical: instead of calling ProtectSection you call UnprotectSection, like this:

C#
Configuration myConfig = WebConfigurationManager.OpenWebConfiguration("/");
ConfigurationSection mySection = myConfig.GetSection("appSettings");
mySection.SectionInformation.UnprotectSection();
myConfig.Save();

VB.NET
Dim myConfig As Configuration = WebConfigurationManager.OpenWebConfiguration("/")
Dim mySection As ConfigurationSection = myConfig.GetSection("appSettings")
mySection.SectionInformation.UnprotectSection()
myConfig.Save()

Things to Watch Out For

This code uses a key to encrypt and decrypt data *local* to the machine where the code runs. That means you'll need to run it on the final destination: the web server where the appSettings section is used. If you encrypt the data on your development machine and then upload the encrypted config file to your web server, you'll get a run-time error when ASP.NET tries to decrypt the data again.

Additionally, the account used by this code (typically the Network Service account on Windows Server versions and Vista and ASPNET on Windows XP) needs read and write permissions to the root folder. This is not the case by default, so you need to grant these permissions to the appropriate account before you run this code. Typically, you want to revert back to read-only access again once you're done encrypting to close the security hole.

If you don't have your site running on / (that is, the Virtual Path property on the web site's Properties dialog in VWD is set to something other than / or you're running your site configured as a Virtual Directory in IIS) but you run the site on something like /WebSite1 instead, you need to change the call to OpenWebConfiguration like this:

WebConfigurationManager.OpenWebConfiguration("/WebSite1")

However, if you run this on a Windows Vista machine, you may get the following error:

System.InvalidOperationException: Failed to map the path '/'.

The error is caused by a security issue: you need to run Visual Studio and the built-in web server under the context of an administrator account. To fix this issue, close Visual Studio, right-click the Microsoft Visual Studio 2008 item on the start menu and choose Run as administrator.

References

This post is not meant to be a guide to encrypting files. It merely serves as an answer to those asking me about encrypting files in my web applications. For more details about encrypting files see the following references:

• How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI
• Using the Management API
• Encrypting Configuration Information in ASP.NET 2.0 Applications

Downloads

• A simple sample application that encrypts and decrypts config files (C# and VB code provided)