How to Properly Set Connection Strings in ASP.NET Core

In this article, we will delve into connection strings providing insights into their functionality, and best practices for safeguarding sensitive data.

Let’s dive in!

Purpose and Components of Connection Strings

Connection strings are the backbone of a connection between our application and a database, encapsulating important information such as server address, database name, and authentication credentials. The connection string aims to simplify and standardize the method through which applications connect to data sources so that developers do not need to hardcode the connection details in their code. Decoupling the connection string in a configuration file makes it easier to adjust connection settings without having to recompile our code, making the application flexible and easier to maintain. Usually, connection strings can be stored in appsettings.json, an environment variable, the user secret store, or another configuration source. 

Now, let’s see an example of the connection string in the appsettings.json file:

{
  "ConnectionStrings": {
    "Connection": "Server=[ServerAddress];Database=[Database];User Id=[Username];Password=[Password];"
  }
}

Here, we can see the components of the connection strings which typically consist of several ones, each specifying essential details to establish a connection between an application and a database. Let’s explore these components in greater detail:

Support Code Maze on Patreon to get rid of ads and get the best discounts on our products!

These are a few of the more critical parameters, but there are quite a few others, many of which are optional. Some may also be specific to a particular database provider.

Setting Up Connection Strings

Now that we understand the connection string and the purpose of it, let’s delve deeper into its practical application.

In our first example, we will see how to retrieve the connection string from the appsettings.json file using a console application:

var connectionString = configuration.GetConnectionString("DefaultConnection");

Here, we can use the IConfiguration to help us to retrieve the connection string from appsettings.json. Then, we assign the result to a variable just for learning purposes.

We could also use this method in Entity Framework Core to retrieve the connection string:

protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
    optionsBuilder.UseSqlServer(configuration.GetConnectionString("DefaultConnection"));
}

We can still use the IConfiguration to help us to retrieve the connection string and assign it to the UseSqlServer() method.

Common Mistakes With Connection Strings

Common mistakes in connection strings include incorrect syntax, missing or incorrect server addresses, improper authentication credentials, using the wrong database provider, and failing to secure sensitive information such as passwords.

The wrong formatting of the connection string leads to a failure in the connection. Not including necessary parameters or placing values in the wrong place will cause problems. Also, by conven ConnectionStrings inside the appsettings.json should be in plural, for our connection strings to be accessible via the GetConnectionString() method.

The connection string is different for each database, so we should check which database we are using. We can use connectionstrings.com to help us to find the right connection string.

Best Practices and Security Considerations

When it comes to connection strings in software development, especially in the context of databases, there are several best practices and security considerations to keep in mind, and by following these best practices and security considerations, we can help ensure that our application’s connection strings are secure and resilient against potential threats and attacks.

Avoid Hardcoding Connection Strings

Let’s see an example of hardcoding a connection string:

protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
    optionsBuilder.UseSqlServer("Server=10.1.1.120;Database=Database;User=Admin;Password=MyStrongPassword;");
} 

Hardcoding connection strings in our code is generally not a recommended practice due to security and maintainability concerns. It can expose sensitive information such as usernames, passwords, and server addresses directly in the code. This increases the risk of unauthorized access if the code is exposed, either intentionally or accidentally. Additionally, don’t commit the connection strings to any repository (public or private) due to security and compliance requirements such as GDPR.

Development Environment

Development environments may be considered less critical than production. But plenty of security incidents have started with compromised development environment credentials. So, we recommend using the user secrets for sensitive information in our local development, it’s a best practice that helps maintain the integrity and security of our application.

Production Environment

Production environments clearly require the most secure practices available, so here are some essential practices to ensure them.

Secure Credential Storage: We do not recommend using the previous methods in the production environment. Instead, we suggest utilizing Environment Variables and secure credential storage solutions like Azure Key Vault and AWS Secrets Manager. These services provide strong encryption and access control mechanisms to safeguard sensitive data.

Connection String Encryption: Consider encrypting connection strings to add another layer of security. Some database systems offer built-in encryption mechanisms for connection strings or third-party encryption solutions.

Regular Rotation: Rotate credentials, such as connection strings, periodically in order to prevent unauthorized access through compromised credentials. Automation should be used as much as possible for the credential rotation process to reduce the need for manual interaction and minimize human error.

Monitoring and Logging: Strong monitoring and logging mechanisms should be used to monitor access to production connection strings. This will increase the visibility of suspicious activity. Keep an eye on the number of changes that occur on the connection strings, checking access logs regularly to detect any security breaches.

Least Privilege Principle: Bind the connection string using credentials that have the least amount of permissions possible to access required resources. Restrict access to production databases and sensitive resources to only authorized users or services.

Conclusion

In this article, we’ve explored the important role of connection strings in bridging applications with databases outlining best practices to mitigate common pitfalls and ensure that all of our environments are accessing their data securely. Apply the strategies we’ve suggested to optimize our database connectivity and protect our sensitive data.

Liked it? Take a second to support Code Maze on Patreon and get the ad free reading experience!