title: asp.net web config security
body: <p>I am thinking about the security of a web config file in an asp.net application, from the point of view that a web config file often contains that connection string to an applications database, and so security is important.</p>
  
  <p>In an asp.net application, a connection string may be retrieved from a web config file using:</p>
  
  <pre><code>ConfigurationManager.ConnectionStrings["connectionstring"]
  </code></pre>
  
  <p>Assuming someone new the key for the connection string, are they able to somehow send that request to the server and get a response, or is there some sort of security that will prevent this happening.</p>
  
  <p>If they are able to do so, how could they do this and what could be done to prevent this eg encrypting the connection string?</p>
  
  <p>EDIT: this is not a duplicate of the question <a href="https://stackoverflow.com/questions/1706613/encrypting-connection-string-in-web-config">Encrypting Connection String in web.config</a> as my question is asking if it is possible to trick the server into giving this information out, and if so how can we prevent it. The named question is asking how to encrypt the data, which is related but not the same</p>