Hi Luis,

Back in the early days of my work with mojoPortal I felt that the connection string should not be a public method or property so I implemented it as private method in each data access class. But my opinion has changed and I agree with you that it would be better to consolidate it in one place so it isn't duplicated in all the different data classes. If you check the latest code in the repository you will see that I have gone through all the classes in the MS SQL data layer and changed them to all use a common method to get the connection string. I will do the same in other data layers as time permits, it is easy to make the changes but its a lot of changes so its a large tedious project to complete it.

This would make it possible to have a config switch to make it possible to use the <connectionStrings section if you don't want to use <appSettings (I haven't made that option yet but I will), then you could encrypt just the <connectionStrings section or you could encrypt <appSettings section and use it as it is today.

I would not encrypt just one key, that would mean you have to decrypt it on every data access and that affects performance. It is better to encrypt a web.config section because that is decrypted just once when the configuration object is cached into memory and we don't have to have any decryption logic anywhere in our code, it is done by the runtime at the point when it reads the section the first time and puts it in memory.

Most appSettings are already encapsulated in the Web/Components/WebConfigSettings.cs class, but that exists in mojoPortal.Web project so it cannot be used in the data layer, since it has no reference to the web layer.

Best,

Joe