Protecting Connection Strings and Other Configuration Information (C#) Introduction Configuration information for ASP.NET applications is commonly stored in an XML file named Web.config . Over the course of these tutorials we have updated the Web.config a handful of times. When creating the Northwind Typed DataSet in the first tutorial , for example, connection string information was automatically added to Web.config in the <connectionStrings> section. Later, in the Master Pages and Site Navigation tutorial, we manually updated Web.config , adding a <pages> element indicating that all of the ASP.NET pages in our project should use the DataWebControls Theme. Since Web.config may contain sensitive data such as connection strings, it is important that the contents of Web.config be kept safe and hidden from unauthorized viewers. By default, any HTTP re...