Read appSettings Encrypted Web.config

Asked

Viewed 158 times

0

In an application that uses classic Asp, I have a key called connection:asp30 and another call connection:asp60. This application has several pages Asp and other aspx.

I encrypted Web.config at the request of a client, use:

aspnet_regiis.exe -Pef "appSettings" "D: Users rafael.Desktop Application - 5.0" -Prov "Dataprotectionconfigurationprovider"

OK.

The connections of . Asp use the connection:asp30 and the . aspx connections use the connection:asp60

When encrypting, the connections of . aspx continued to work regularly, however, the . SP stopped working.

The connection of . Asp works as follows:

  strConexao = GetXmlProp("connection:asp30", "")
  gstrConn = strConexao

  Set rst = Server.CreateObject("ADODB.Recordset")
  Set rstConf = Server.CreateObject("ADODB.Recordset")
  Set objConnection =  Server.CreateObject("ADODB.Connection")
  objConnection.Open gstrConn

Being the function:

Function GetXmlProp(propName, stdvalue) Dim Node Dim cfgFile   Dim fso
      If IsEmpty(objXMLCfg) Or IsNull(objXMLCfg)  Then

    'determinar web.config
    cfgFile = Session("ApplicationRootPath") & "\web.config"

    Set fso = Server.CreateObject("Scripting.FileSystemObject")
        If Not fso.FileExists(cfgFile) Then       Response.Write "Atenção: arquivo " & cfgFile & " não encontrado."     End If
        Set fso = Nothing

    Set objXMLCfg = Server.CreateObject("Microsoft.XMLDOM")
    objXMLCfg.Async = False
    objXMLCfg.Load(cfgFile)   
           End If    
    Set Node = objXMLCfg.documentElement.selectSingleNode("/configuration/appSettings/add[@key='" & propName & "']")
     If Not Node Is Nothing Then
    GetXmlProp = Node.getAttribute("value")   Else
    GetXmlProp = stdvalue   End If
     End Function

What can I do to make my Web.config understood and the application access the database in the layer . Asp ?

asp

  • The safest way would be to create a database class in your application to manipulate its sql, there you would create rules, you could create a list with your connections and via programming they would be triggered.

1 answer

3

Once encrypted the Voce file can no longer access this section "Prov" by ASP.

To solve your problem, and make your client happy, I would use some ASP Encryption/Decryptor and put the encrypted connection string in another session on your web.config (another path other than "Prov") that did not pass the aspnet_regiis.

That is, your ASP would use its own encryption and its connection string would not be visible to someone reading straight from the web.config file.

If the client does not like this solution, Voce can log in by aspx, redirect to an Asp, passing this string Connection in a session variable and using on the ASP side.

Browser other questions tagged asp

You are not signed in. Login or sign up in order to post.