Menu
If the best practice for handling sensitive data in Java is to use character arrays, why do most methods in Spring Security use String or CharSequence? For example the methods on Encryptors take CharSequence. In fact, looking at the source code of those methods, they actually end up converting the CharSequence to a String. Since the folks on that project have more lifetimes of experience in these matters than I will ever have, I feel like I must be missing something. Does anyone have any insight into how to pass sensitive data to these methods?
425
Since String is immutable, there is no method defined that allow us to change or overwrite the content of the string. This feature makes string objects unstable for storing secure information such as passwords, SSN, etc. We should always store the secure information in char[] array rather than String.
Spring Security supports many password encoders, for both old and modern algorithms. Also, Spring Security provides methods to work with multiple password encodings in the same application.
Since Strings are immutable there is no way the contents of Strings can be changed because any change will produce a new String, while if you use a char[] you can still set all the elements as blank or zero. So storing a password in a character array clearly mitigates the security risk of stealing a password.
Since Strings are immutable there is no way the contents of Strings can be changed because any change will produce new String, while if you char[] you can still set all his elements as blank or zero. So Storing the password in a character array clearly mitigates security risk of stealing passwords.
You really cannot do much to reduce the life of the password in a Servlet container because the HttpServletRequest returns the HTTP parameters as a String. So Spring Security could take all the measures in the world to reduce the lifetime of the password but it wouldn't make a difference because the String would already exist.
-Rob Winch (Spring Security)
Source
121
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
