Skip to content

Commit 204ff85

Browse files
authored
Clarify and add security note about PersistSecurityInfo (#7546)
1 parent 9af03c6 commit 204ff85

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

xml/System.Data.SqlClient/SqlConnectionStringBuilder.xml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2017,14 +2017,17 @@ False
20172017
<ReturnType>System.Boolean</ReturnType>
20182018
</ReturnValue>
20192019
<Docs>
2020-
<summary>Gets or sets a Boolean value that indicates if security-sensitive information, such as the password, is not returned as part of the connection if the connection is open or has ever been in an open state.</summary>
2021-
<value>The value of the <see cref="P:System.Data.SqlClient.SqlConnectionStringBuilder.PersistSecurityInfo" /> property, or <see langword="false" /> if none has been supplied.</value>
2020+
<summary>Gets or sets a value indicating if security-sensitive information, such as the password or access token, should be returned as part of the connection string on a connection created with this <see cref="T:System.Data.SqlClient.SqlConnectionStringBuilder" /> after that connection has ever been in an open state.</summary>
2021+
<value><see langword="true" /> if security-sensitive information should be returned as part of the connection string; otherwise, <see langword="false" />. The default is <see langword="false" />.</value>
20222022
<remarks>
20232023
<format type="text/markdown"><![CDATA[
20242024
20252025
## Remarks
20262026
This property corresponds to the "Persist Security Info" and "persistsecurityinfo" keys within the connection string.
20272027
2028+
> [!NOTE]
2029+
> This property should only be set to `true` if your application has a specific need to read the password out of an already-opened database connection. The default value of `false` is the more secure setting. Using `true` for this property opens your application to security risks, such as accidentally logging or tracing the database password.
2030+
20282031
]]></format>
20292032
</remarks>
20302033
<related type="Article" href="/dotnet/framework/data/adonet/connection-strings">Connection Strings in ADO.NET</related>

0 commit comments

Comments
 (0)