Programmactly change in your web.config in releasemode - web-config

Question

I have been roaming around the internet to figure out what the best solution to my issue would be, but I cant seem to find a satisfying answer.
My problem is, that I wish an administrator of my website to be able to change a server-setting (email, password and Exchange server endpoint url) - this should be possible to do in the browser, so the admin doesnt have to open up the web.config file.
The settings are rarely set, but the possibility for it HAS to be present.
What I do now, is that once the admin fills out my form, my controller will set the new values in the web.config AppSettings:
<appSettings>
<add key="ewsUser" value="some#thing.com" />
<add key="ewsPW" value="somePW" />
<add key="ewsUrl" value="https://outlook.ews.com/xxx.asmx" />
</appSettings>
This is where my big concern begins, because of all my research through out the internet.
Lets say my application now is online, and is being used by hundreds of people 24/7, would this solution then be an issue?
I have read that if you make changes to your web.config file it will make your application restart on the server, without throwing off any clients. But will this affect the session the clients are in right in that moment? Will the server forget their sessions?
I've read a bit on bad practices, and this article states how it could be solved by making a new .config file and link to that config file in the web.config AppSettings. But is this really necessary? I find it a bit more messy than my current solution.
Any ideas, thoughts and/or facts would be appriciated.

Answer 1

Writing to a web.config is indeed a bad practice. When changing a web.config file your application will restart. Not sure about the sessions though but they will probably reset. And what about the situation where you deploy a new version of your application and accidentally overwrite the web.config?
Two solutions that might be helpful:
Create a simple key/value table in a database
Create your custom XML format and write/read to a file (and name the file for example mysettings.config instead of mysettings.xml to prevent direct access from a webbrowser)
To speed-up things you could cache these values in memory after reading.