web.config文件中保存敏感信息，安全否？

Question

How To Use the ASP.NET Utility to Encrypt Credentials and Session State Connection Strings
http://support.microsoft.com/default.aspx?scid=329290
Enhanced and Secure Connection Strings in Web.Config
http://www.codeproject.com/aspnet/secure_connectionstrings.asp

Answer 1

' /  .- .
                                                          .  .- .-
                                                        ./    .--...
                                              .-------- 0    .--
                                             /                 .......
                                            '                  ..
                                             '........            ----
                                                      .          --..
                                                       .   .---..   -
                                   分  o               .  '     -.
                                     分               /   '
                                                     / ' ' '
                                   \-分--/....... . '  ' '  '
                                    \ __/ -      - -'  '  ' '
                                                    '  '  ' '
                                     o              '   ' ' '
                                                    '   '  '
                                                     -..'.----------.
                                                        I   ----------
                                                 /////////.

Answer 2

也可以写在一个类里,编译进dll,发布的时候只发布dll,aspx等

Answer 3

以前在csdn中没看过楼上这广告
楼上的产品服务还真多

Answer 4

http://www.csdn.net/Develop/read_article.asp?id=27204
我在该文中说明如何编码这些敏感的信息，你可以稍加修改应用加密算法实现！

Answer 5

没问题的，只要你的WebService里不要轻易调用DataSet.AcceptChanges(),就不会显示<appSetings></appSetings>里的敏感信息。

Answer 6

自己写一个连接类，编译成DLL，在项目里引用。这样比写在web.config里要安全些
但是如果要改变连接信息，用DLL的话，就必须重新编译。这样比写在web.config里要麻烦些 :p