Editorials

Secure Your Connection String

Here’s an old problem for which the solution continues to creep out now and again. How do you make your database connection string for applications? I was reminded of this again on one of my group forums for Java. The author was pointing out that many times our connection strings are not only visible, but sometimes find themselves embedded in our version control repository.

In dot net you can use an encrypted section in your application configuration file making managing your connection string somewhat easier. I’m not sure how that would work with Slow Cheetah which allows you to use XSLT to transform your configuration file during the build process for different build configurations. It would still probably work, but take a little figuring out.

The point is that it doesn’t make sense to hard code database connection information into the application code, saving it in clear text is problematic, and we need have it handy so that it can be managed and modified easily as things are moved around, either applications or databases.

What is your solution? Are there any techniques you have found that work well for you? Is there a tool you use to manage your connection strings, or is this something we continue to build over and over? Get into the conversation by sharing your thoughts in comments below.

Cheers,

Ben