title: How can I secure passwords stored inside web.config?
body: <p>I have added the following settings inside my web.config file to initiate an API call to external system. So I am storing the API URL + username + password as follows:-</p>
  
  <pre><code>&lt;appSettings&gt;
      &lt;add key="ApiURL" value="https://...../servlets/AssetServlet" /&gt;
      &lt;add key="ApiUserName" value="tmsservice" /&gt;
      &lt;add key="ApiPassword" value="test2test2" /&gt; 
  </code></pre>
  
  <p>Then inside my action method I will be referencing these values when building the web client as follows:-</p>
  
  <pre><code>public ActionResult Create(RackJoin rj, FormCollection formValues)
          {
             XmlDocument doc = new XmlDocument();
             using (var client = new WebClient())
                  {
                      var query = HttpUtility.ParseQueryString(string.Empty);
                      foreach (string key in formValues)
                      {
                          query[key] = this.Request.Form[key];
                      }
  
                      query["username"] = System.Web.Configuration.WebConfigurationManager.AppSettings["ApiUserName"];
                      query["password"] = System.Web.Configuration.WebConfigurationManager.AppSettings["ApiPassword"];
  
                      string apiurl = System.Web.Configuration.WebConfigurationManager.AppSettings["ApiURL"];
  </code></pre>
  
  <p>But in this was I will be exposing the username and password and these can be captured by users, so my question is how I can secure the API username and password?</p>