从源代码部署到Azure时如何确保ASP.NET数据库连接字符串的安全

I was working with Rob Conery today during lunch moving the This Developer's Life podcast website to Git. We recorded the whole upgrade and migration experience and it will be up as a video on TekPub soon.

今天我在午餐时间与Rob Conery合作，将This Developer's Life播客网站移至Git。 我们记录了整个升级和迁移的经验，并将很快在TekPub上作为视频播放。

Shameless Plug: Check out my TekPub show "The Source" available on TekPub.tv.

无耻插头：检查出我TekPub节目“源”上可用TekPub.tv 。

A question came up during the deployment. We moved our database from SQL Compact to a SQL Server instance in Azure. But, how do we keep our database connection strings a secret? We are pushing our source code to GitHub and don't want our connection strings and passwords committed as well.

部署过程中出现了一个问题。 我们将数据库从SQL Compact移到了Azure中SQL Server实例。 但是，如何使数据库连接字符串保密？ 我们正在将源代码推送到GitHub，并且也不想提交我们的连接字符串和密码。

Sometimes you'll make a Web.Release.Config file and keep them in there. Sometimes you'll make a connectionStrings.config and refer to it from the web.config but never deploy it.

有时您会制作一个Web.Release.Config文件并将其保存在该文件中。 有时，您将创建一个connectionStrings.config并从web.config引用它，但永远不要部署它。

However, Azure lets you keep those configuration settings in Azure securely so they never end up in code. Note the screenshot below. There's a Connection String named "TDL." This matches the name that we reference in code and the name of the connection string in our web.config.

但是，Azure允许您将这些配置设置安全地保存在Azure中，这样它们就永远不会出现在代码中。 请注意以下屏幕截图。 有一个名为“ TDL”的连接字符串。 这与我们在代码中引用的名称和web.config中的连接字符串的名称匹配。

Our ASP.NET Web Pages database call was to Database.Open in WebMatrix.Data. It's pretty simple. Dead simple, in fact.

我们的ASP.NET Web Pages数据库调用是WebMatrix.Data中的Database.Open。 很简单死简单，其实。

var db = Database.Open("TDL");

This used to refer to a TDL.sdf SQL Server Compact Edition (SQL CE) file. Then we moved it into a connection string.

这曾经是指TDL.sdf SQL Server精简版(SQL CE)文件。 然后我们将其移动到连接字符串中。

<connectionStrings>
  <add name="TDL" connectionString="blah blah" providerName="yada yada"/>
</connectionStrings>

The idea is that if your Azure configuration (as seen in the screenshot above) has an value with the same name, that secure value from Azure will get replaced when your app is deployed.

这个想法是，如果您的Azure配置(如上面的屏幕快照所示)具有同名的值，则在部署您的应用程序时，来自Azure的安全值将被替换。

GOTCHA WARNING: I spent twenty minutes trying to figure out why my value wasn't getting updated. My app was was acting as if there was no connection string value at all. I was getting "Connection string "TDL" was not found." After much gnashing of teeth I discovered (thanks to David Ebbo's help) that I had put my <connectionStrings> element inside of <runtime> within the web.config and the error was being swallowed. Apparently that section is pretty relaxed about elements it doesn't understand - certainly more relaxed that the system.web section. Regardless, in the hope that it save some visitor (perhaps you!) time, make sure your connectionStrings element is right at the tine under <configuration/>

GOTCHA警告：我花了二十分钟试图弄清楚为什么我的价值没有得到更新。 我的应用程序表现得好像根本没有连接字符串值。 我收到“找不到连接字符串“ TDL”。” 经过大量的咬牙切齿之后，我发现(由于David Ebbo的帮助)，我将我的<connectionStrings>元素放在了web.config中的<runtime>内，并且错误被吞没了。 显然，该部分对不了解的元素非常放松-当然，与system.web部分相比，放松了很多。 无论如何，希望节省一些访问者(也许是您！)的时间，请确保您的connectionStrings元素正确地位于<configuration />下的常规位置。

All in all, this worked very well for us.

总而言之，这对我们来说非常有效。

It let us put our code on GitHub, setup automatic deployment to Azure directly from GitHub, while still keeping our SQL connection strings (and any additional production settings) private.

它使我们可以将代码放在GitHub上，直接从GitHub设置自动部署到Azure，同时仍将我们SQL连接字符串(以及任何其他生产设置)保持私有。

翻译自: https://www.hanselman.com/blog/how-to-keep-your-aspnet-database-connection-strings-secure-when-deploying-to-azure-from-source