7

I understand this question can be general but, specifically with regards to ASP.NET MVC, what's the best way to keep passwords locally but not in git/svn? My database connection string is currently in web.config -- is it best to somehow include a file in web.config that isn't in git? What do you folks do?

Christopher
  • 1,635
  • 5
  • 19
  • 30

3 Answers3

9

I use Windows Auth with my databases, so the connection string contains a server name but not a username/password.

For Machines where I can't use Windows Auth, I use web.config transforms and add the web.dev.config to my .gitignore.

Michael Stum
  • 177,530
  • 117
  • 400
  • 535
7

Regarding Git, I would use a filter driver in order to build the right web.config out of:

  • a web.config.template file,
  • an external (encrypted) source where to look for the password.

enter image description here

On every checkout, the 'smudge' script would be the right web.config content, that way:

  • web.config remains private (only visible in your working tree)
  • common parts of the web.config which don't change often and are public information remain versioned in web.config.template.
  • the password, even encrypted, don't get replicated from repository to repository.
Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
0

put the web.config in your .gitignore file. The web.config will not change very often.

Roger
  • 1,004
  • 2
  • 12
  • 24