3.2 Configuration Data

When Web applications are deployed, there are often constant data values that need to be modified so that the application runs properly on the deployment server. Examples of such values include database connection strings and preferences or settings that influence the appearance or behavior of the application. ASP.NET configuration files provide a specific element for storing generic name /value pairs, called appSettings , which is ideal for storing these types of settings. It supports a subelement called add , which takes a key and value pair of attributes, as shown in Listing 3-3.

Listing 3-3 Specifying Application-Specific Configuration Data

 <!-- File: web.config --> <configuration>   <appSettings>     <add key="DSN"          value="server=localhost;uid=sa;pwd=;database=pubs"     />     <add key="bgColor" value="white" />   </appSettings> </configuration> 

In this example, we have chosen to store two pieces of application-specific data: a data source connection string and a background color . Placing data like this in a configuration file makes it very easy to customize these values by simply changing them in the configuration file. This is especially appealing for data that may change from one site installation to another. It is also an efficient mechanism for storing and retrieving small amounts of data, because the entire contents of the configuration file are loaded into memory when the application starts, so there is no file access involved with retrieving the values once they have been loaded. Once key/value pairs have been added to the appSettings element, you can extract them from any page or object in your application using the ConfigurationSettings class, as shown in Listing 3-4.

Listing 3-4 Retrieving appSettings Configuration Data

 <!-- File: samplepage.aspx --> <%@ Page Language='VB' %> <%@ Import Namespace='System.Configuration' %> <script runat=server> Protected Sub Page_Load(src As Object, e As EventArgs)   Dim dsn As String   dsn = ConfigurationSettings.AppSettings("DSN")   ' use dsn to connect to a database...   ' (or just display here)   _dsn.Text = dsn   Dim bgColor As String   bgColor = ConfigurationSettings.AppSettings("bgColor")   ' use retrieved background color...   _body.Attributes("bgColor") = bgColor End Sub </script> <!-- remainder of page not shown --> 

Note in Listing 3-4 that the namespace System.Configuration was imported, because that is where the ConfigurationSettings class resides. This class provides a static indexer called AppSettings that is used to retrieve the values indexed by their key in the appSettings element of a configuration file. The keys used to index the appSettings element are not case sensitive, so be aware that bgColor and BgColor , for example, will map to the same element.

One frequently asked question is, What prevents someone from directly accessing the web.config file in my application, potentially revealing the database login information and other data that should be protected? Fortunately, ASP.NET has a built-in handler called the HttpForbiddenHandler that is designed to restrict access to particular files. Among the files designated to use this handler are any files ending with the extension .config (also protected are .cs , .vb , .asax , .resx , and others). When this handler is invoked by an attempt to access any file with a forbidden extension, it returns an HTTP error code of 403, indicating that the access is forbidden; so by default, configuration settings are inaccessible to external clients .