== How to fix it in Entity Framework Core

=== Code examples

The following code uses an empty password to connect to a SQL Server database. 

The vulnerability can be fixed by using Windows authentication (sometimes referred to as integrated security).

==== Noncompliant code example

[source,csharp,diff-id=302,diff-type=noncompliant]
----
protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
  optionsBuilder.UseSqlServer("Server=myServerAddress;Database=myDataBase;User Id=myUsername;Password="); // Noncompliant
}
----


==== Compliant solution

[source,csharp,diff-id=302,diff-type=compliant]
----
protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
  optionsBuilder.UseSqlServer("Server=myServerAddress;Database=myDataBase;Integrated Security=True");
}
----

=== How does this work?

include::../../common/fix/windows-authentication.adoc[]

=== Pitfalls

include::../../common/pitfalls/hard-coded.adoc[]
