== How to fix it in ASP.NET

=== Code examples

The following configuration file uses an empty password to connect to a database. 

The vulnerability can be fixed by using Windows authentication (sometimes referred to as integrated security)

==== Noncompliant code example

[source,csharp,diff-id=301,diff-type=noncompliant]
----
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <connectionStrings>
    <add name="myConnection" connectionString="Server=myServerAddress;Database=myDataBase;User Id=myUsername;Password=" /> <!-- Noncompliant -->
  </connectionStrings>
</configuration>
----

==== Compliant solution

[source,csharp,diff-id=301,diff-type=compliant]
----
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <connectionStrings>
    <add name="myConnection" connectionString="Server=myServerAddress;Database=myDataBase;Integrated Security=True" />
  </connectionStrings>
</configuration>
----

=== How does this work?

include::../../common/fix/windows-authentication.adoc[]

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]
