Question

1. Why would you want to store usernames and passwords in the Web.Config file?

2. Create an ASP.NET page that uses a GridView to display the books from the Books table and a RadioButtonList of all the authors to allow the user to filter the books displayed. (Be sure to set the RadioButtonList's AutoPostBack property to True.)
Make sure that the RadioButtonList displays only unique author names. In addition, because on the initial page load, the RadioButtonList will not have any item selected, you will need to set a default value for the parameter you create in the GridView's SqlDataSource Wizard. Set the default parameter value to a blank string. With this setting, when the page first loads, before a user selects an author from the list of radio buttons, the GridView should not be shown because there should be no authors with a blank string. Upon selecting a new author, the page will post back and the books that the selected author has written will be displayed.

please write the code and screenshot the output

Answer 1

Answer:

1)

Generally, web.config is a secure file and IIS does not serve it, therefore it will not be exposed to users who are making requests to web server. Web server only serves specific type of files and web.config is surely not one of 'em.

Quite often you save your database connection string in it which includes password. Now imagine an scenario where web.config was not secure. You have created a major security threat to your application.

Therefore, specially as long as your project is not too big, you should not be worrying about it.

Yet, you may have a better approach but creating a project called "Resources" and save all the critical information such as settings, consts, enums and etc in there. That would be a slick and organized approach.

If you are passing the username/password over the wire though (for example in case of a secured API call), you may want to use https to make sure that information that are travelling are encrypted but that has nothing to do with the security of web.config file.

web.config security has nothing to do with https. if you are sending/receiving the data over wire, then that's where https comes to play. if you are using the information on web.config only on your server, you don't need to do anything and you are good to go. what i see above is that you are in fact sending information over wire which sure does need http, but that has nothing to do with web.config security. you can be getting that info from a class propert.