title: Is setting a connection string in web.config a security vulnerability? (ASP.NET MVC, Entity Framework)
body: <p>I am developing a ASP.NET MVC 5 web application with Entity Framework 6 using a MySQL database. My Connection string in web.config looks like this:</p>
  
  <pre><code>&lt;connectionStrings&gt;
           &lt;add name="IdentityDB" connectionString="Data Source=localhost; User Id=user;Password=Password;database=myDatabase;" providerName="MySql.Data.MySqlClient"/&gt;  
  &lt;/connectionStrings&gt;
  </code></pre>
  
  <p>So, my question is: Are there some security issues about the connection string being in <code>web.config</code>? Because when I publish the application, the <code>web.config</code> file will be in www. </p>
  
  <p>Is that a problem? How can I hide the connection string or the password?</p>
  
  <p>Thanks,
  Beardy Bear</p>