# ASP.NET 3.5 and Database Security
**URL:** https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268
**Category:** Factual Questions
**Created:** [August 5, 2010, 2:27pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268 "2010-08-05T14:27:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Eutychus](https://boards.straightdope.com/u/Eutychus)
#### Post date: [August 5, 2010, 2:27pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268/1 "2010-08-05T14:27:56Z")
Just to entertain myself while I’m gainfully unemployed I’ve been toying with an [ASP.NET](http://ASP.NET) website. It accesses an access database that I created stored in the AppData directory of the site.
I’d like to add a login/password feature, but I’ve noted that if you know the name of the database and the correct directory you can download the database directly, thus giving one access to all the passwords.
So … if someone has the chance, edumacate me a bit about database security in [ASP.NET](http://ASP.NET) 3.5 and what I have to do to get around this conundrum.
---
### Author:  [@friedo](https://boards.straightdope.com/u/friedo)
#### Post date: [August 5, 2010, 2:35pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268/2 "2010-08-05T14:35:55Z")
Don’t put the database file inside the web root, for one.
Secondly, don’t store plaintext passwords in the database. Use a hashing function like SHA-256, and store the hashed passwords. When somebody tries to login, compare the hash of the password they provide to what’s in the database.
---
### Author:  [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)
#### Post date: [August 5, 2010, 4:26pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268/3 "2010-08-05T16:26:20Z")
The built-in [ASP.NET](http://ASP.NET) login system can do the hashing and checking for you, btw.
---
### Author:  [@Eutychus](https://boards.straightdope.com/u/Eutychus)
#### Post date: [August 5, 2010, 4:48pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268/4 "2010-08-05T16:48:37Z")
> [@ZipperJJ](#):
>
> The built-in [ASP.NET](http://ASP.NET) login system can do the hashing and checking for you, btw.
Yeah, I was hoping to find a way around that. Microsoft’s Login system doesn’t translate well to a 64 bit system which is what I’m running right now. I’m running Windows 7 Home Edition and the only way I can use the 32 bit system is to upgrade to the Professional or Enterprise Editions. So I’m trying to find a workaround before I break down and cough up the 200 bucks for that.
---
### Author:  [@tetranz](https://boards.straightdope.com/u/tetranz)
#### Post date: [August 5, 2010, 5:17pm UTC](https://boards.straightdope.com/t/asp-net-3-5-and-database-security/549268/5 "2010-08-05T17:17:28Z")
Specified file extensions can be blocked from being served by IIS.
It’s usually in your master config file at:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config
See the \ section.
All the common file extensions that you don’t want to serve are usually setup by default when IIS is installed. \*.mdb files should certainly be blocked. If your IIS is serving \*.mdb then that suggests something didn’t get quite right in your IIS or .NET installation. It might be worth running aspnet\_regiis.exe.
The previous advice is good too. It’s usually best for this stuff to not be in the web root at all but I think Microsoft provided this feature to help people who are using low cost shared hosting where you sometimes only get access to the web root.