How to make hard coded connection string safe in an downloadable app.

Question

Hi!

I have an downloadable app, that need to be downloadable and started locally. This app works with my own database. So I have the connection string hardcoded in the app(I know this is bad practice, but have not found a way around it). So recently I have found that the connection string to database is easily found in dll/exe with reverse engineering.

So my question is, is there some way to use Azure key vault or other good solution. Where the app is still downloadable to have locally on computer, have access to the database but the connection string not hardcoded or at least close to impossible to reverse engineer from dll/exe?

Answer 1

Hello @Fredrik Olsen , in order to avoid giving access to a database connection string from your local application you could move the database access workload to a custom API. APIS are best suited to store secrets such as password and connection strings. You application would authenticate and get authorized against your API which in turn would get authorized to gain access to KeyVault or better yet, directly to your database (provided is deployed in the cloud).

Take a look to the following docs for more information:

• Desktop app that calls web APIs
• Mobile application that calls web APIs
• On-behalf-of flows with MSAL.NET or Client credential flows in MSAL.NET
• Microsoft Authentication Library for iOS and macOS
• Managed identities for Azure resources documentation: to avoid handling credentials in your API + Which SDK to use - Azure SDK or MSAL?
• About Azure Mobile Apps: client and api multiplatform all in one developement that avoids separate client and API development

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.