title: Where is the best practice for keeping config info in an ASP.NET MVC application?
body: <p>I am wondering the general convention for keeping configuration information related to the fields below for 2 concerns below:</p>
  
  <p><strong>A > Security concern</strong> </p>
  
  <p><strong>B > Update concern</strong> (in case the config should be updated by the user instead of developer).</p>
  
  <p><strong>1)</strong> I define database connection string information (database, user and password) in web.config. Is there another way i.e. keeping in cs file? I think it is impossible to keep it in the same database that application use. </p>
  
  <p><strong>2)</strong> My application send e-mail and I define the credentials in the *.cs class of e-mail. Is it true? By keeping into account that this info is changed and there is no developer to support, is it good idea to keep them in database and allow user to update them via application? </p>
  
  <p><strong>3)</strong> What is the approaches for all of the scenarios (config, update and *.cs file)? For example when keeping e-mail credentials in the database, should I get these info from database just before the usage? Or is there another approach i.e. writing it to a temporary file and then reuse it until it is changed in the database, etc.) </p>
  
  <p>Any help would be appreciated. </p>