Hi Dmitri,

We've written a little program that reads the entire App.config and looks for the connectionstring in the domain tag. Using encryption we de-/encrypt the connectionstring. When it is encrypted it is surrounded by '{}' when not it is not surrounded. In our program we test the connectionstring for starting with '{' and ending with '}' and decrypt when needed. This way our application is capable of working with both en- and decrypted connectionsstrings. Super!

I don't completely agree with you concerning:

'I believe that DataObjects.Net as well as any other ORM is not responsible for securing connection strings'

When one uses the standard connectionstring there is functionality in the Configuration that can un-/lock a connectionstring. That makes en-/decrypting quite easy. Because the connectionstring is in a custom DO tag we can not use this functionality. What I would expect of DO is an easy read/write access to the connectionstring.

But there is nothing preventing you from getting encryptedConnectionString on step 3 from standard configuration section.

I.e.:

var config = DomainConfiguration.Load("mydomain");
var connectionString = ...; // Read it by any way you like
config.ConnectionInfo = new ConnectionInfo(
  "sqlserver", connectionString);
...

Hello Paul, please take a look at this idea, we need your feedback.

DataObjects.Net 4.3.7 & 4.4 beta 2 with this feature is released.