Protected configuration enables you to encrypt sections of an ASP.NET application's Web.config file in order to protect sensitive information used by the application. This can improve the security of your application by making it difficult for an attacker to gain access to the sensitive information even if an attacker gains access to your Web.config file. ASP.NET includes two protected configuration providers that can be used to encrypt sections of a Web.config file:
In some cases, you might need to encrypt information using an algorithm other than those available with the RSA or DPAPI providers. In that case, you can build a custom protected configuration provider to be used by ASP.NET.
Required Classes for Protected Configuration Providers
To implement a protected configuration provider, you create a class that inherits the
Required ProviderBase Members
Sets property values for the provider instance, including implementation-specific values and options supplied in the application configuration.
Takes as input the name of the provider and a
Required ProtectedConfigurationProvider Members
Performs the encryption. Takes as input an
The Encrypt method encrypts the
The format of the contents of the EncryptedData element is determined by your implementation. When the element is decrypted, ASP.NET will pass an XmlNode object to the
Performs the decryption. Takes as input an XmlNode object containing the EncryptedData element of an encrypted configuration section. For example, if the connectionStrings section is the configuration section that was encrypted, the XmlNode object represents XML data similar to highlighted XML in the following example.
The Decrypt method decrypts the contents of the XmlNode object and returns an XmlNode object that represents the decrypted contents of the EncryptedData XmlNode object. For example, if the connectionStrings section was encrypted, the Decrypt method returns an XmlNode object with XML data similar to the following example.
For an example custom protected configuration provider that uses the