{"record":{"id":"bcd8648c3ef481e8","repo":"tursodatabase/turso","slug":"encryption-is-not-supported-by-libraryname","errorCode":null,"errorMessage":"Encryption is not supported by {libraryName}.","messagePattern":"Encryption is not supported by (.+?)\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data.Sqlite/SqliteConnection.cs","lineNumber":95,"sourceCode":"    {\n        get => _readUncommitted;\n        set => _readUncommitted = value;\n    }\n\n    // The SQLite version Turso tracks (SQLITE_VERSION in core/dialect/sqlite.rs).\n    public override string ServerVersion => \"3.50.4\";\n\n    public override ConnectionState State => _database is null ? ConnectionState.Closed : ConnectionState.Open;\n\n    protected override DbProviderFactory DbProviderFactory => SqliteFactory.Instance;\n\n    public override void Open()\n    {\n        ObjectDisposedException.ThrowIf(_disposed, this);\n        if (_database is not null)\n            throw new InvalidOperationException(\"The connection is already open.\");\n        if (!string.IsNullOrEmpty(_connectionOptions.Password))\n            throw new InvalidOperationException(Properties.Resources.EncryptionNotSupported(\"e_sqlite3\"));\n\n        var originalState = State;\n        var filename = NormalizeDataSource(_connectionOptions);\n        var readOnly = _connectionOptions.Mode == SqliteOpenMode.ReadOnly;\n        var sharedMemoryPath = IsSharedMemory(_connectionOptions) ? RegisterSharedMemoryFile(filename) : null;\n        try\n        {\n            _database = TursoBindings.OpenDatabase(filename);\n            _dataSource = filename;\n            _readOnly = readOnly;\n            _sharedMemoryPath = sharedMemoryPath;\n            ApplyExtensionSettings();\n            ApplyConnectionOptions();\n            RegisterScalarFunctions();\n            RegisterAggregateFunctions();\n            RegisterCollations();\n            LoadPendingExtensions();\n            OnStateChange(new StateChangeEventArgs(originalState, State));","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/tursodatabase/turso/blob/244cde92a7df7f9b8b8b7a4075c35a12977e303e/bindings/dotnet/src/Turso.Data.Sqlite/SqliteConnection.cs#L77-L113","documentation":"Open() throws InvalidOperationException when the connection string contains a non-empty Password, because the Turso SQLite-compatible provider (backed by the e_sqlite3 native library) is built without encryption support (no SQLITE_HAS_CODEC/SEE). The check happens before any file is opened, so no database is created or touched. This intentionally fails fast instead of silently ignoring the password and writing an unencrypted file.","triggerScenarios":"'Data Source=enc.db;Password=secret' in the connection string; connection strings copied from SQLCipher, System.Data.SQLite (with codec), or SEE-based deployments; shared config files that carry a Password key for all providers.","commonSituations":"Migrating an encrypted database from another SQLite distribution and assuming the Turso provider reads the same option; multi-provider config where a global Password property is applied to every connection string; leftover Password keys from an earlier stack.","solutions":["Remove the Password entry from the connection string (it is never honored by this provider).","If data-at-rest encryption is required, use an approach outside this provider: full-disk/OS file encryption, EFS/LUKS, or a provider that ships SQLCipher and convert the file there.","Encrypt/decrypt sensitive columns at the application layer (e.g. AES via a UDF or in code) instead of whole-file encryption."],"exampleFix":"// before\nvar cs = new SqliteConnectionStringBuilder { DataSource = \"enc.db\", Password = \"secret\" };\nusing var conn = new SqliteConnection(cs.ToString());\nconn.Open(); // throws: Encryption is not supported by e_sqlite3\n\n// after\nvar cs = new SqliteConnectionStringBuilder { DataSource = \"plain.db\" };\nusing var conn = new SqliteConnection(cs.ToString());\nconn.Open(); // encrypt at the application layer if needed","handlingStrategy":"validation","validationCode":"static string StripUnsupportedPassword(string cs)\n{\n    var b = new SqliteConnectionStringBuilder(cs);\n    if (b.TryGetValue(\"Password\", out var pwd) && !string.IsNullOrEmpty(pwd?.ToString()))\n    {\n        b.Remove(\"Password\");\n        // decide policy here: fail loudly, or proceed unencrypted knowingly\n    }\n    return b.ConnectionString;\n}\n\n// usage: new SqliteConnection(StripUnsupportedPassword(cs))","typeGuard":null,"tryCatchPattern":"null","preventionTips":["Do not share one config template with a Password key across providers.","Document whole-file encryption as unsupported with this provider; choose app-layer or OS-level encryption deliberately.","Fail configuration validation at startup if a Password appears in a Turso connection string, rather than discovering it at first Open."],"tags":["ado-net","sqlite","turso","connection-string","encryption","config"],"backgroundTag":"unsupported-connection-string-option","analyzedSha":"244cde92a7df7f9b8b8b7a4075c35a12977e303e","analyzedAt":"2026-08-20T07:02:18.389Z","contentChangedAt":"2026-08-20T07:02:18.389Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}