Create an ASP.NET Client Web Application

Test the Application

Modify the Web Application to Read an Encrypted Connection String from Web.Config

Start Visual Studio .NET and create a new C# ASP.NET Web application called DPAPIClientWeb.

Add a reference to the DataProtector.dll assembly, previously created in "Appendix ."

Open WebForm1.aspx.cs and add the following using statements to the top of the file beneath the existing using statements.

using System.Text;
using DataProtection;

Add the controls listed in Table 1 to WebForm1.aspx.

Your Web form should look similar to Figure 1.

Figure 1. DPAPIClientWeb Web Form

Double-click the Encrypt button to create a button click event handler.

DataProtector dp = new DataProtector( DataProtector.Store.USE_MACHINE_STORE );
try
{
  byte[] dataToEncrypt = Encoding.ASCII.GetBytes(txtDataToEncrypt.Text);
  // Not passing optional entropy in this example
  // Could pass random value (stored by the application) for added security
   // when using DPAPI with the machine store.
  txtEncryptedData.Text =
                Convert.ToBase64String(dp.Encrypt(dataToEncrypt,null));
}
catch(Exception ex)
{
  lblError.ForeColor = Color.Red;
  lblError.Text = "Exception.<br>" + ex.Message;
  return;
}
lblError.Text = "";

Return to the Web form and double-click the Decrypt button. Add the following code to the button click event handler.

DataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE);
try
{
  byte[] dataToDecrypt = Convert.FromBase64String(txtEncryptedData.Text);
  // Optional entropy parameter is null.
  // If entropy was used within the Encrypt method, the same entropy parameter
  // must be supplied here
  txtDecryptedData.Text =
                     Encoding.ASCII.GetString(dp.Decrypt(dataToDecrypt,null));
}
catch(Exception ex)
{
  lblError.ForeColor = Color.Red;
  lblError.Text = "Exception.<br>" + ex.Message;
  return;
}
lblError.Text = "";

On the Build menu, click Build Solution.

Press Ctrl+F5 to run the Web application.

Enter a string in the Data to Encrypt text box and click Encrypt.

Confirm that encrypted data (in Base64 encoded format) is displayed in the Encrypted Data text box.

Click the Decrypt button.

Confirm that the encrypted data is successfully decrypted and displayed in the Decrypted Data text box.

Return to Visual Studio .NET and display the WebForm1.aspx in Designer mode.

Add another button to the form. Set its Text property to Decrypt string from config file and its ID property to btnDecryptConfig.

Double-click the button to create a button click event handler.

Add the following using statement to the top of the file beneath the existing using statements.

using System.Configuration;

Return to the btnDecryptConfig_Click event handler and add the following code to retrieve a database connection string from the <appSettings> section of the Web.config file.

DataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE);
try
{
  string appSettingValue =
            ConfigurationSettings.AppSettings["connectionString"];
  byte[] dataToDecrypt = Convert.FromBase64String(appSettingValue);
  string connStr = Encoding.ASCII.GetString(
                               dp.Decrypt(dataToDecrypt,null));
  txtDecryptedData.Text = connStr;
}
catch(Exception ex)
{
  lblError.ForeColor = Color.Red;
  lblError.Text = "Exception.<br>" + ex.Message;
  return;
}
lblError.Text = "";

On the Build menu, click Build Solution to rebuild the projects.

Right-click WebForm1.aspx, and then click View in Browser.

Enter a database connection string such as the one that follows into the Data to Encrypt field.

server=(local);Integrated Security=SSPI; database=Northwind

Click the Encrypt button.

Select the encrypted cipher text and copy it to the clipboard.

Switch to Visual Studio .NET, open Web.config and add the following <appSettings> element outside of the <system.web> element. Assign the encrypted connection string currently on the clipboard to the value attribute.

<appSettings>
   <add key="connectionString" value="encrypted connection string"/>
</appSettings>

Save Web.config.

Click the Decrypt string from config file button and confirm that the encrypted database connection string is successfully read from the Web.config file and that the decrypted connection string is successfully displayed in the Decrypted data field.