Following the recent discovery of this asp.NET security flaw, i checked all my production web.config to set the correct custom errors,
and also to verify that connection strings are encrypted.

As you certainly now, you can do it on the server with the aspnet-regiis.exe command..;
but you have to run it manually, and take care not to upload an unencrypted web.config later... not very practical when you manage dozens of websites...

As there is an easy way to encrypt web.config section programmatically,
i found wise to have the application_start check that the connectionString is encrypted, and do it automatically otherwise...

Sub Application_OnStart()
        
        Dim config As Configuration = WebConfigurationManager.OpenWebConfiguration(HttpRuntime.AppDomainAppVirtualPath)
        Dim section As ConfigurationSection = config.GetSection("connectionStrings")
            If (section.SectionInformation.IsProtected) = False Then
                section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider")
                config.Save()
            End If
                          
End Sub

To avoid encrypting the connection on the development server, i simply added a test and a key in the appsettings...

    Sub Application_OnStart()
        
        If ConfigurationManager.AppSettings("AutomaticallyEncryptConnectionStrings") Is Nothing _
        OrElse CType(ConfigurationManager.AppSettings("AutomaticallyEncryptConnectionStrings"), Boolean) = True Then
            
            Dim config As Configuration = WebConfigurationManager.OpenWebConfiguration(HttpRuntime.AppDomainAppVirtualPath)
            Dim section As ConfigurationSection = config.GetSection("connectionStrings")
            If (section.SectionInformation.IsProtected) = False Then
                section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider")
                config.Save()
            End If
        End If

                   
    End Sub

appsettings key :

    <appSettings>
        <add key="AutomaticallyEncryptConnectionStrings" value="false"/>      
    </appSettings>

Please note that i used HttpRuntime.AppDomainAppVirtualPath and not  Request.ApplicationPath,
because there is no context available in Application_start when running in integrated mode

Now I can again sleep soundly...