I have this ongoing quest to figure out the best practices for creating customizations for SalesLogix web client that will not cause downstream pain come the time a new update comes from Sage. At times there are places that you just cannot avoid to get your fingers into but more and more I believe we should avoid altering the web.config file.
I know its quite easy to add extra app settings, or configuration settings there however doing so means the files has to be included in the check list when doing an upgrade.
From a standpoint of reducing the cost of future upgrades I am proposing that any of your component based configurations should use a separate file. Use the same naming convention as ending your settings with *.config to ensure the outside world cannot view it but store it inside of the app_data folder instead of root. I am also thinking that the configuration file should have a naming prefix such as <companyname>_<area>_settings.config this way new items can be provided/shared between business partners without worry of naming collisions.
I know that this deviates from the ease of use of the included .net configuration libraries but in the long run it makes the application more maintainable.