R – Is encrypting web.config pointless

You need at least write access to the filesystem to be able to decrypt it, assuming you're using the DPAPI provider. Ways to decrypt it include:

• Copy an aspx page containing decryption code to the server and navigate to it
• Log in on the server and run an application to decrypt it.

But it protects against decryption by an unauthorised user who has read access to the filesystem or a backup of the filesystem.

Typically you would set up your production servers so that only authorized adminstrators can log in to the server or write to its filesystem.

Developers might have remote read access for support purposes, and would not be able to decrypt the config file remotely.

Encryption/decryption is easy with standard libraries: the hard part is ensuring only authorized people have access to the keys.

If you're using DPAPI, you're essentially delegating management of the keys to Windows security. If you use another provider such as RSA, you need to store the key somewhere, and protect it against unauthorized access e.g. using an ACL.

for the command "aspnet_regiis -pef" the path of configuration file is the physical path (Not virtual) and also it is the path of directory/folder where web.config resides. So one should not include the name of file in path e.g.

if your web.config path is at D:\MyConfiguration\web.config then while encrypting/decrypting you will use it as follow:

encrypt:

aspnet_regiis -pef [sectionName] "D:\MyConfiguration"

decrypt:

aspnet_regiis -pdf [sectionName] "D:\MyConfiguration"