{"record":{"id":"e97241a99cd0f797","repo":"tursodatabase/turso","slug":"encryption-cipher-and-encryption-key-are-local-dat","errorCode":null,"errorMessage":"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.","messagePattern":"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnection.cs","lineNumber":329,"sourceCode":"        {\n            remoteClient.CloseAsync(DefaultTimeout, CancellationToken.None).GetAwaiter().GetResult();\n        }\n        catch\n        {\n            InvalidateRemoteSession();\n        }\n    }\n\n    private void OpenRemote()\n    {\n        if (_connectionOptions.IsReplica)\n            throw new NotSupportedException(\"Embedded replica connections are not supported yet by the .NET provider. Use a remote URL without Replica Path for direct remote execution.\");\n\n        if (_connectionOptions.SyncInterval > 0)\n            throw new NotSupportedException(\"Sync Interval requires embedded replica support, which is not supported yet by the .NET provider.\");\n\n        if (_connectionOptions.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(_connectionOptions[\"Encryption Key\"]))\n            throw new InvalidOperationException(\"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.\");\n\n        _remoteClient = new TursoRemoteClient(_connectionOptions.GetRemoteUri(), _connectionOptions.AuthToken);\n    }\n\n    private void ValidateLocalOnlyOptions()\n    {\n        if (!string.IsNullOrWhiteSpace(_connectionOptions.AuthToken))\n            throw new InvalidOperationException(\"Auth Token requires a remote Turso URL Data Source.\");\n        if (!string.IsNullOrWhiteSpace(_connectionOptions.ReplicaPath))\n            throw new InvalidOperationException(\"Replica Path requires a remote Turso URL Data Source.\");\n        if (_connectionOptions.SyncInterval > 0)\n            throw new InvalidOperationException(\"Sync Interval requires a remote embedded replica connection.\");\n        if (_connectionOptions.Tls.HasValue)\n            throw new InvalidOperationException(\"Tls requires a remote Turso URL Data Source.\");\n    }\n\n    private void CloseRemote()\n    {","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/tursodatabase/turso/blob/244cde92a7df7f9b8b8b7a4075c35a12977e303e/bindings/dotnet/src/Turso.Data/TursoConnection.cs#L311-L347","documentation":"OpenRemote's third guard rejects local-only encryption options on remote URLs: Encryption Cipher and Encryption Key configure file-level encryption when opening a local database natively, and are meaningless over the wire, so supplying either (the check ORs a parsed cipher and any non-whitespace 'Encryption Key') with a remote Data Source throws InvalidOperationException at Open().","triggerScenarios":"Open() with 'Data Source=libsql://...;Encryption Cipher=aes256;Encryption Key=<hex>'; setting only 'Encryption Key' without a cipher on a remote URL; secrets managers injecting encryption keys into all connection strings uniformly.","commonSituations":"Security-hardened config templates applied to every environment; migrating an encrypted local database to Turso Cloud while keeping the keys in the string; copying between local and remote connection strings in appsettings.","solutions":["Remove 'Encryption Cipher' and 'Encryption Key' for remote connections — TLS secures the channel and the server handles encryption at rest","Keep encryption options only on local file connection strings","If you need a local encrypted database, use a file path Data Source where cipher plus key are honored"],"exampleFix":"// before\nvar cs = \"Data Source=libsql://db.turso.io;Auth Token=...;Encryption Cipher=aes256;Encryption Key=a1b2...\";\n\n// after\nvar cs = \"Data Source=libsql://db.turso.io;Auth Token=...\";","handlingStrategy":"validation","validationCode":"var opts = TursoConnectionOptions.Parse(cs);\nif (opts.IsRemote && (opts.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(opts[\"Encryption Key\"])))\n    throw new InvalidOperationException(\n        \"Remove encryption options: they only apply to local file databases.\");","typeGuard":"static bool EncryptionOptionsMatchMode(string cs)\n{\n    var opts = TursoConnectionOptions.Parse(cs);\n    var hasEncryption = opts.GetEncryptionCipher().HasValue\n        || !string.IsNullOrWhiteSpace(opts[\"Encryption Key\"]);\n    return opts.IsRemote ? !hasEncryption : true;\n}","tryCatchPattern":"try { conn.Open(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Encryption Cipher and Encryption Key are local\"))\n{\n    // strip Encryption Cipher/Encryption Key from the remote connection string and retry\n}","preventionTips":["Keep encrypted-database keywords only on local file connection strings","Scope secrets-manager injections of encryption keys to local configs","Rely on TLS plus server-side encryption for remote connections"],"tags":["csharp","dotnet","turso","encryption","connection-string","remote"],"backgroundTag":"invalid-connection-string-option","analyzedSha":"244cde92a7df7f9b8b8b7a4075c35a12977e303e","analyzedAt":"2026-08-20T07:02:18.389Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}