c# - 连接字符串安全 C#

Question

我创建了一个使用 mysql 来验证用户登录的 c# 程序。我在 google 上搜索了有关连接字符串安全性的内容，所有内容都与 web.config 文件有关。是否有必要在纯 c# 程序中隐藏连接字符串？如果是，请给我引用。

我加密我的代码，这足以保护我程序中的连接字符串吗？

private static MySqlConnection myConnection = new MySqlConnection("sample connection string");

解决问题后的微小编辑:我发现用于加密为连接字符串设计的 App.config 的错误文章和项目，您可以查看它 here

Answer 1

可以引用Securing Connection Strings .

you should encrypt the configuration file so that the user name andpassword are not exposed in clear text.

因此将连接字符串放在配置文件中并对其进行加密是确保连接字符串安全的一种方法。

Encrypt Configuration Files

You can also store connection strings in configuration files, whicheliminates the need to embed them in your application's code.Configuration files are standard XML files for which the .NETFramework has defined a common set of elements. Connection strings inconfiguration files are typically stored inside the element in the app.config for a Windowsapplication, or the web.config file for an ASP.NET application.

MSDN 引用:

• Protecting Connection Information
• How To: Secure Connection Strings when Using Data SourceControls