Why is it a bad idea to save dynamic data in web.config?

Question

My company has an application that programmatically saves a single value in the web.config file. The web.config file is updated approximately every five minutes.

James Curran reports that it is a bad idea to programmatically change web.config in this answer Dynamically change connectionString in web.config , but it does not explain why this is a bad idea.

I am looking for reasons to convince my boss not to store any dynamic data in the web.config file. Links to good articles are especially welcome.

Answer 1

The application restarts every time you change web.config, for starters.

Answer 2

This is a bad idea, because every time you change the configuration file, the web application restarts. In addition, if you use the website project, it will also be compiled every time you change the configuration. Thus, you will have problems with productivity and responsibility. You boss probably don't want this :)

Answer 3

In addition to restarting applications, you have several security-related values ​​stored in your Web.config file. Your application should not even have write permissions to this file.

Answer 4

The main risk is that the files in the root folder or * .config files can be written by the web server process. This would look like a serious security flaw.

What you can do is the usual task to modify the web.config file if the user who owns this task does not have write permissions to the web server.