{"record":{"id":"e97241a99cd0f797","repo":"tursodatabase/turso","slug":"encryption-cipher-and-encryption-key-are-local-dat","errorCode":null,"errorMessage":"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.","messagePattern":"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnection.cs","lineNumber":473,"sourceCode":"            InvalidateRemoteSession();\n        }\n    }\n\n    private void OpenRemote()\n    {\n        if (_connectionOptions.IsReplica)\n        {\n            OpenReplica();\n            return;\n        }\n\n        if (_connectionOptions.SyncInterval > 0)\n            throw new NotSupportedException(\"Sync Interval requires an embedded replica connection.\");\n        if (_connectionOptions.HasAdvancedReplicaOptions)\n            throw new NotSupportedException(\"Advanced sync options require an embedded replica connection.\");\n\n        if (_connectionOptions.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(_connectionOptions[\"Encryption Key\"]))\n            throw new InvalidOperationException(\"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.\");\n\n        var handler = RemoteMessageHandlerFactory?.Invoke();\n        _remoteClient = handler is null\n            ? new TursoRemoteClient(_connectionOptions.GetRemoteUri(), _connectionOptions.AuthToken)\n            : new TursoRemoteClient(\n                new HttpClient(handler),\n                _connectionOptions.GetRemoteUri(),\n                _connectionOptions.AuthToken,\n                disposeHttpClient: true);\n    }\n\n    private void OpenReplica()\n    {\n        var lease = TursoReplicaRegistry\n            .AcquireAsync(\n                CreateReplicaOptions(),\n                _connectionOptions.Pooling,\n                TimeSpan.FromSeconds(_connectionOptions.SyncInterval),","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/tursodatabase/turso/blob/6c7252267988c76e632af00a671e4b9788dfae13/bindings/dotnet/src/Turso.Data/TursoConnection.cs#L455-L491","documentation":"OpenRemote's third guard rejects local-only encryption options on remote URLs: Encryption Cipher and Encryption Key configure file-level encryption when opening a local database natively, and are meaningless over the wire, so supplying either (the check ORs a parsed cipher and any non-whitespace 'Encryption Key') with a remote Data Source throws InvalidOperationException at Open().","triggerScenarios":"Open() with 'Data Source=libsql://...;Encryption Cipher=aes256;Encryption Key=<hex>'; setting only 'Encryption Key' without a cipher on a remote URL; secrets managers injecting encryption keys into all connection strings uniformly.","commonSituations":"Security-hardened config templates applied to every environment; migrating an encrypted local database to Turso Cloud while keeping the keys in the string; copying between local and remote connection strings in appsettings.","solutions":["Remove 'Encryption Cipher' and 'Encryption Key' for remote connections — TLS secures the channel and the server handles encryption at rest","Keep encryption options only on local file connection strings","If you need a local encrypted database, use a file path Data Source where cipher plus key are honored"],"exampleFix":"// before\nvar cs = \"Data Source=libsql://db.turso.io;Auth Token=...;Encryption Cipher=aes256;Encryption Key=a1b2...\";\n\n// after\nvar cs = \"Data Source=libsql://db.turso.io;Auth Token=...\";","handlingStrategy":"validation","validationCode":"var opts = TursoConnectionOptions.Parse(cs);\nif (opts.IsRemote && (opts.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(opts[\"Encryption Key\"])))\n    throw new InvalidOperationException(\n        \"Remove encryption options: they only apply to local file databases.\");","typeGuard":"static bool EncryptionOptionsMatchMode(string cs)\n{\n    var opts = TursoConnectionOptions.Parse(cs);\n    var hasEncryption = opts.GetEncryptionCipher().HasValue\n        || !string.IsNullOrWhiteSpace(opts[\"Encryption Key\"]);\n    return opts.IsRemote ? !hasEncryption : true;\n}","tryCatchPattern":"try { conn.Open(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Encryption Cipher and Encryption Key are local\"))\n{\n    // strip Encryption Cipher/Encryption Key from the remote connection string and retry\n}","preventionTips":["Keep encrypted-database keywords only on local file connection strings","Scope secrets-manager injections of encryption keys to local configs","Rely on TLS plus server-side encryption for remote connections"],"tags":["csharp","dotnet","turso","encryption","connection-string","remote"],"backgroundTag":"invalid-connection-string-option","analyzedSha":"6c7252267988c76e632af00a671e4b9788dfae13","analyzedAt":"2026-09-06T07:15:26.990Z","contentChangedAt":"2026-09-06T07:15:26.990Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}