ASP.NET MVC · Production

Web.config

Web.config is the control panel of an MVC 5 app: database connections, feature switches, security settings and IIS behaviour all live in this one XML file.

Advanced 6 min Lesson 34 of 37Covers ASP.NET MVC 5.2 on .NET Framework 4.8.

Before you start:Logging

0/37 in ASP.NET MVC

On this page · 6 min · Advanced

Interview questions

Learning objectives#

Store and read settings and connection strings
Wrap settings in a typed class
Keep secrets out of source control with an external file
Change settings per environment with config transforms

Explanation#

<appSettings> holds key–value pairs read with ConfigurationManager.AppSettings["Key"] — always strings, so convert them. <connectionStrings> holds database connections read with ConfigurationManager.ConnectionStrings["Name"].

Wrap settings in a small class (AppSettings.FreeDeliveryOver) that parses and validates them once, so the rest of the code never sees raw strings or misspelled keys.

<appSettings file="secrets.config"> merges an extra file over the main settings. Keep secrets.config out of source control and create it on each server — or let Azure App Service settings override appSettings at runtime.

Config transforms (Web.Debug.config, Web.Release.config) change values when you publish: xdt:Transform="SetAttributes" with xdt:Locator="Match(key)" replaces a value; xdt:Transform="RemoveAttributes(debug)" removes debug="true".

Changing Web.config on a live server restarts the application (and clears InProc session). Plan changes for quiet times.

Syntax#

Razor / Markup Illustrative

1<appSettings file="secrets.config">
2  <add key="Shop:FreeDeliveryOver" value="500" />
3</appSettings>
4<connectionStrings>
5  <add name="ShopDb" connectionString="Server=.;Database=Shop;Integrated Security=True" providerName="System.Data.SqlClient" />
6</connectionStrings>

Code example: Typed settings, a secrets file and a release transform#

C#Web.config Illustrative

1<!-- Web.config -->
2<?xml version="1.0" encoding="utf-8"?>
3<configuration>
4  <connectionStrings>
5    <add name="ShopDb" connectionString="Server=(localdb)\mssqllocaldb;Database=ShopMvc5;Integrated Security=True" providerName="System.Data.SqlClient" />
6  </connectionStrings>
7  <appSettings file="secrets.config">
8    <add key="webpages:Version" value="3.0.0.0" />
9    <add key="webpages:Enabled" value="false" />
10    <add key="Shop:Name" value="Techie Stationers" />
11    <add key="Shop:FreeDeliveryOver" value="500" />
12    <add key="Features:GiftCards" value="false" />
13    <add key="Payments:ApiKey" value="set-in-secrets.config" />
14  </appSettings>
15  <system.web>
16    <compilation debug="true" targetFramework="4.8" />
17    <httpRuntime targetFramework="4.8" maxRequestLength="10240" />
18    <customErrors mode="RemoteOnly" />
19  </system.web>
20</configuration>
21

22<!-- secrets.config -->
23<appSettings>
24  <add key="Payments:ApiKey" value="sk_test_51Hx9" />
25</appSettings>
26

27<!-- Web.Release.config -->
28<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
29  <appSettings>
30    <add key="Features:GiftCards" value="true" xdt:Transform="SetAttributes" xdt:Locator="Match(key)" />
31  </appSettings>
32  <system.web>
33    <compilation xdt:Transform="RemoveAttributes(debug)" />
34    <customErrors mode="On" xdt:Transform="SetAttributes" />
35  </system.web>
36</configuration>
37

38// App_Start/AppSettings.cs
39using System;
40using System.Configuration;
41

42namespace ShopSite
43{
44    public static class AppSettings
45    {
46        public static string ShopName => Read("Shop:Name");
47        public static decimal FreeDeliveryOver => decimal.Parse(Read("Shop:FreeDeliveryOver"));
48        public static bool GiftCardsEnabled => bool.Parse(Read("Features:GiftCards"));
49        public static string PaymentsKey => Read("Payments:ApiKey");
50

51        private static string Read(string key)
52        {
53            var value = ConfigurationManager.AppSettings[key];
54            if (string.IsNullOrWhiteSpace(value))
55                throw new ConfigurationErrorsException(
quot;Missing app setting '{key}'");
56            return value;
57        }
58    }
59}
60

61// Controllers/SettingsController.cs
62using System.Configuration;
63using System.Web.Configuration;
64using System.Web.Mvc;
65

66namespace ShopSite.Controllers
67{
68    public class SettingsController : Controller
69    {
70        public ActionResult Index()
71        {
72            var db = ConfigurationManager.ConnectionStrings["ShopDb"];
73            var runtime = (HttpRuntimeSection)ConfigurationManager.GetSection("system.web/httpRuntime");
74            return Content(
75                
quot;Shop: {AppSettings.ShopName}\n" +
76                
quot;Free delivery over: {AppSettings.FreeDeliveryOver:0}\n" +
77                
quot;Gift cards enabled: {AppSettings.GiftCardsEnabled}\n" +
78                
quot;Payments key: {AppSettings.PaymentsKey.Substring(0, 7)}… (from secrets.config)\n" +
79                
quot;Database provider: {db.ProviderName}\n" +
80                
quot;Max request: {runtime.MaxRequestLength} KB\n" +
81                
quot;Debug compilation: {HttpContext.IsDebuggingEnabled}",
82                "text/plain");
83        }
84    }
85}

Expected output

GET /Settings
200 OK
Shop: Techie Stationers
Free delivery over: 500
Gift cards enabled: False
Payments key: sk_test… (from secrets.config)
Database provider: System.Data.SqlClient
Max request: 10240 KB
Debug compilation: True

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

AppSettings reads each key once through ConfigurationManager and converts it to the right type, throwing a clear error if a key is missing.
Payments:ApiKey is defined in Web.config as a placeholder, but secrets.config (merged through file="…") overrides it with the real value.
The connection string and httpRuntime values come from their own sections.
Locally, debug compilation is on and gift cards are off. When you publish in Release, Web.Release.config turns gift cards on, removes debug="true" and switches customErrors to On.

Real-world use case#

A retailer runs the same MVC 5 app for three countries. Each server has its own secrets.config with payment keys and a transform sets the currency and tax settings, so the code and the main Web.config are identical everywhere.

Common mistakes#

Committing secrets in Web.config

Connection strings with passwords and API keys in Git are leaked with every clone. Use a secrets file, environment-specific transforms built on the server, or App Service settings.

Leaving debug="true" in production

Debug compilation disables batching and optimisations and makes errors more verbose. The Release transform should remove it.

Reading raw strings everywhere

ConfigurationManager.AppSettings["FreeDelivery"] scattered across the code breaks silently on a typo. Centralise keys in one class.

Best practices#

Group keys with prefixes like Shop: and Features:
Validate settings at startup
Keep secrets out of source control
Use transforms or deployment settings per environment

Remember this#

AppSettings = strings; convert them once.

file="secrets.config" overrides keys locally.

Web.Release.config transforms on publish.

Practice exercise#

Your task: Add a Shop:SupportEmail setting and show it on a contact page through the AppSettings class, failing clearly when it is missing.

Need a hint?

Add public static string SupportEmail => Read("Shop:SupportEmail");

Show solution

C# Illustrative

1<!-- Web.config -->
2<?xml version="1.0" encoding="utf-8"?>
3<configuration>
4  <appSettings>
5    <add key="webpages:Version" value="3.0.0.0" />
6    <add key="webpages:Enabled" value="false" />
7    <add key="Shop:SupportEmail" value="help@techie-stationers.example" />
8  </appSettings>
9  <system.web>
10    <compilation debug="true" targetFramework="4.8" />
11    <httpRuntime targetFramework="4.8" />
12  </system.web>
13</configuration>
14

15// Controllers/ContactController.cs
16using System.Configuration;
17using System.Web.Mvc;
18

19namespace ShopSite.Controllers
20{
21    public class ContactController : Controller
22    {
23        public ActionResult Index()
24        {
25            var email = ConfigurationManager.AppSettings["Shop:SupportEmail"];
26            if (string.IsNullOrWhiteSpace(email)) throw new ConfigurationErrorsException("Missing Shop:SupportEmail");
27            return Content("Write to us: " + email, "text/plain");
28        }
29    }
30}

Expected output

GET /Contact
200 OK
Write to us: help@techie-stationers.example

Mini quiz#

Web.config quizMultiple choice Question 1 of 3

What type does ConfigurationManager.AppSettings["Key"] return?

Score so far: 0/0

Want more? Practise all ASP.NET MVC MCQs · ASP.NET MVC interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.

On this page

Related tutorials

Interview questions

Learning objectives#

Explanation#

Syntax#

Code example: Typed settings, a secrets file and a release transform#

Step-by-step explanation#

Real-world use case#

Common mistakes#

Best practices#

Remember this#

Practice exercise#

Mini quiz#

Related topics#

My notes#