Home / server / Questions / 573743
Accepted
Mircea Chirea
Asked: 2014-02-07 11:02:37 +0800 CST

Application Settings outside of web.config

  • 772

I need to keep the production app settings section outside of Web.config; I don't want keys and other secret information to be kept inside source code repository. However, if I edit the app settings with IIS Mananger it changes the Web.config, which will be overwritten at the next deployment.

How can I keep those settings outside of the Web.config that comes with the application on deployment? For example, this is somehow done by Azure Web Sites - the app settings you configure in the portal are not stored in Web.config - that can be confirmed by downloading the file via FTP. How is it done?

iis

2 Answers

  1. Best Answer

    For the appSettings and connectionStrings nodes in web.config you can move these into separate files outside of web.config.

    In your web.config you would have:

    <appSettings configSource="appsettings.config"></appSettings>

    and then a new file appsettings.config:

     <?xml version="1.0"?>
 <appSettings>
     <add key="foo" value="bar" /> 
 </appSettings>

    Then you have to make sure that you don't deploy these new files and keep them different on the production server and your dev environment.

    All my web.config files are excluded from my deployment process, if I need to change them, I do that on the stage or production sites.

    • 5

  2. In addition to the web.config file(s) in your sites there are several global settings for IIS.

    %systemroot%\System32\inetsrv\config\applicationHost.config

    has all the global IIS settings, depending on your Feature Delegation settings these can be overwritten in your local web.config(s). But you can prevent this by setting a feature to 'Read Only' in Feature Delegation on the server level.

    For dot.NET related settings there are two global files:

    %systemroot%\Microsoft.NET\Framework??\v?.?.????\CONFIG\machine.config
%systemroot%\Microsoft.NET\Framework??\v?.?.????\CONFIG\web.config

    There are several versions of these files, one for each framework version for each OS platform.

    Any settings done in these files are inherited by your local web.config.

    However I don't think there is a way that you can prevent a local web.config from overriding settings set in the global files.

    • 0