How to encrypt the Telerik appSettings keys

AUTHOR: Marin Bratanov

DATE POSTED: May 03, 2018

HOW TO

Encrypt the Telerik settings in the web.config.

DESCRIPTION

In some cases you may want to avoid storing information in plain text to improve security. While most of the settings the UI for ASP.NET AJAX controls use are flags, some contain keys or folder paths. To minimize the risk of this data being used without authorization (e.g., by someone who has file access to a shared server), you may want to encrypt the relevant web.config sections.

SOLUTION

ASP.NET provides the aspnet_regiis tool that allows you to encrypt portions of the web.config, among other things. This process is transparent to the ConfigurationManager claas that the Telerik controls use to fetch the appSettings flags they use.

To encrypt the appSettings section, follow these steps:

1. Open the Visual Studio Command Prompt. You may need to do this as an Administrator, depending on the machine setup and particular permissions.
2. Run the following command:
   aspnet_regiis -pef appSettings "d:\TelerikWebApp1\TelerikWebApp1" -prov "DataProtectionConfigurationProvider"
   where you must replace the sample path with the actual path to the folder containing the web.config file

To decrypt the appSettings section, follow these steps:

1. Open the Visual Studio Command Prompt. You may need to do this as an Administrator, depending on the machine setup and particular permissions.
2. Run the following command:
   aspnet_regiis -pdf appSettings "d:\TelerikWebApp1\TelerikWebApp1"
   where you must replace the sample path with the actual path to the folder containing the web.config file

IMPORTANT NOTES

There are a few things you need to keep in mind if you decide to use this:

• The default encryption is done with the MachineKey. This means that you must encrypt data only on the machine that will consume it. If you encrypt the web.config before deployment the actual server may not be able to read it.
• Telerik  cannot guarantee the full transparency of this encryption process. We use the ConfigurationManager class to obtain settings from the web.config and if you start see errors or settings not being applied, you may need to remove the encryption.
• There are many different switches that the aspnet_regiis tool provides, including different syntax for the commands shown above. In our tests they seemed to behave differently on different machines and you may need to review the Microsoft documentation on the tool if you encounter issue (link is available below).

SEE ALSO

• MSDN: How to: Encrypt a web.config File
• CodeProject: Encrypting ASP.NET Application Settings
• Telerik web.config settings overview
• How to use a separate config file for Telerik appSettings

EXPECTED RESULTS

Here is an example of what you can expect to change in the web.config:

Before:

After: